EUVD-2026-76853

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-90535

Flowise versions prior to 3.1.4 are affected by an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint. The root cause is the absence of ownership verification on the user-supplied chatflowId and chatId parameters, allowing an attacker to terminate active ...