What’s Vulnerable › Vulnerabilities

CVE-2026-90535: Flowise before 3.1.4 Denial of Service via text-to-speech/abort

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-12 · updated 2026-09-15
• Weakness: CWE-862

Description

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.

Affected products

• FlowiseAI Flowise: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.1.4. Check the vendor advisory for mitigations.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r
• https://www.vulncheck.com/advisories/flowise-before-3.1.4-denial-of-service-via-text-to-speech-abort
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r

Get alerted when CVE-2026-90535 or the next vulnerability affects your stack