CVE-2026-90535: Flowiseai Flowise

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.

Affected products

• Flowiseai Flowise: before 3.1.4 (fixed in 3.1.4)

Published 2026-09-12. Last modified 2026-09-15.