Description
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FlowiseAI | Flowise | < 3.1.4 | 3.1.4 |
Advisories 1
- WID-SEC-2026-3086 Flowise: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen und DoS BSI CERT-Bund (WID) · Sep 13, 2026
References
- GitHub Security Advisory (GHSA-xhxx-56g3-mx2r) vendor-advisory
- VulnCheck Advisory: Flowise before 3.1.4 Denial of Service via text-to-speech/abort third-party-advisory