PT-2026-71431

CVE-2026-73603

Published

2026-08-04

Updated

2026-10-23

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4

Description An issue exists where the software fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint. This allows unauthenticated attackers to abuse private chatflow text-to-speech credentials by providing a valid chatflow UUID. Consequently, attackers can generate unlimited audio using stored OpenAI or ElevenLabs API keys, leading to financial costs for the chatflow owner.

Recommendations Update to version 3.1.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Offset

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers