CVE-2026-73603: Flowiseai Flowise

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.

Affected products

• Flowiseai Flowise: before 3.1.4 (fixed in 3.1.4)

Published 2026-08-13. Last modified 2026-09-04.