PT-2026-90640 · Flowiseai+1 · Flowise
CVSS v3.1
7.5
عالية
| المتجه | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Flowise versions prior to 3.1.4
Description
An unauthenticated denial of service issue exists in the '/api/v1/text-to-speech/abort' endpoint. The system accepts the
chatflowId and chatId variables without verifying ownership, allowing attackers to terminate active chatflow predictions for any user by providing known identifiers, which results in targeted service disruption.Recommendations
Update to version 3.1.4 or later.
استغلال
إصلاح
DoS
Missing Authorization
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Flowise