CVE-2026-90535

6.3 mediumEPSS 0.5%

Medium (6.3) in flowiseai flowise. EPSS 0.5% chance of exploitation in the next 30 days.

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.

Severity

CVSS 4.0

6.3 medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-09-12
Modified: 2026-09-15
Record from: the NVD, synced 2026-10-19

Affected

flowiseai:flowise

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r
https://www.vulncheck.com/advisories/flowise-before-3.1.4-denial-of-service-via-text-to-speech-abort
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhxx-56g3-mx2r

Check your stack JSON