VYPR
← All advisories
High severity7.5NVD Advisory· Published Sep 12, 2026· Updated Sep 15, 2026

CVE-2026-90535

CVE-2026-90535

Description

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Flowiseai/Flowise3 versions
    cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*range: <3.1.4
    • (no CPE)range: <3.1.4
    • (no CPE)range: <3.1.4

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.