GHSA-8GJ2-2CVC-6XX7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Summary The /api/v1/text-to-speech/generate endpoint is whitelisted requires no authentication and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential OpenAI or...