THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-90535 — Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user

[NVD] CVE-2026-90535 — Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user

mednvdPublished 2026-09-12

CVE-2026-90535 CVSS: None Published: 2026-09-12T13:16:51.380

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat ident

Indicators of compromise

CVE-2026-90535cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-90535