6 matches found
CVE-2026-90535
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...
EUVD-2026-76853
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...
CVE-2026-90535
Flowise versions before 3.1.4 are affected by an unauthenticated denial-of-service vulnerability in the /api/v1/text-to-speech/abort endpoint. The root cause is that the endpoint accepts user-supplied chatflowId and chatId values without ownership verification, allowing an attacker to terminate a...
CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...
PT-2026-90640
šØ CVE-2026-90535 Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user ...
CVE-2026-90535: Missing Authorization
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...