Vulnerability Description
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flowiseai | Flowise | < 3.1.4 |
Related Weaknesses (CWE)
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2rExploitVendor Advisory
- https://www.vulncheck.com/advisories/flowise-before-3.1.4-denial-of-service-via-Third Party Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2rExploitVendor Advisory
FAQ
What is CVE-2026-90535?
CVE-2026-90535 is a vulnerability with a CVSS score of 7.5 (HIGH). Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership...
How severe is CVE-2026-90535?
CVE-2026-90535 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-90535?
Check the references section above for vendor advisories and patch information. Affected products include: Flowiseai Flowise.