CVE-2026-90535

Flowise versions prior to 3.1.4 are affected by an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint. The root cause is the absence of ownership verification on the user-supplied chatflowId and chatId parameters, allowing an attacker to terminate active ...