Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck

CVE-2026-90535Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Medium 6.3

In plain English

A medium-severity missing authorization in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.5%top 58.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.

Affected products (as reported)

Vendor	Product	Versions
FlowiseAI	Flowise	0 – before 3.1.4

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-xhxx-56g3-mx2r) vendor-advisory
VulnCheck Advisory: Flowise before 3.1.4 Denial of Service via text-to-speech/abort third-party-advisory