CVE-2026-56277

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2

Description The text-to-speech (TTS) generation endpoint packages/server/src/controllers/text-to-speech/index.ts sets the Access-Control-Allow-Origin header to a hardcoded wildcard (*), ignoring the server's configured CORS policy. This bypasses the restrictive default CORS configuration handled by the getCorsOptions() function, allowing any webpage to initiate cross-origin requests that trigger TTS generation using stored credentials. This can lead to drive-by cross-origin credential abuse, where a malicious site triggers actions on the server using the victim's authenticated session.

Recommendations Update to version 3.1.2 or later.