CVE-2026-73603
Received Received - Intake

Flowise Unauthenticated TTS Abuse via Chatflow Visibility Flaw

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73603
EUVD
EUVD-2026-57807

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowise flowise to 3.1.4 (exc)
flowiseai flowise to 3.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flowise before version 3.1.4 has a vulnerability in its unauthenticated text-to-speech endpoint. The system fails to check if a chatflow is public before allowing text-to-speech generation. Attackers can exploit this by providing a valid chatflow UUID, using stored API keys (OpenAI or ElevenLabs) to generate unlimited audio without authentication. This leads to unauthorized use of private credentials and costs incurred by the chatflow owner.

Detection Guidance

Check Flowise logs for unusual activity in the /api/v1/text-to-speech/generate endpoint. Monitor for unauthenticated requests with valid chatflow UUIDs. Verify if private chatflow TTS credentials are being used without proper authorization checks.

Impact Analysis

If you own a vulnerable Flowise instance, attackers can abuse your private TTS API keys to generate unlimited audio, causing unexpected financial charges. Your API quotas may be exhausted, leading to service disruptions. Even if you use public chatflows, the lack of validation exposes your credentials to misuse.

Compliance Impact

This vulnerability could lead to unauthorized data processing or API usage, potentially violating GDPR principles like data protection by design and default. For HIPAA, unauthorized API access might compromise protected health information if TTS involves sensitive data. Organizations may face compliance violations due to credential abuse and lack of access controls.

Mitigation Strategies

Upgrade Flowise to version 3.1.4 or later. Implement rate limiting on the /api/v1/text-to-speech/generate endpoint. Ensure the isPublic status of chatflows is verified before allowing TTS generation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart