PT-2026-90640

CVE-2026-90535

Published

2026-09-12

Updated

2026-09-16

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4

Description An unauthenticated denial of service issue exists in the '/api/v1/text-to-speech/abort' endpoint. The system accepts the chatflowId and chatId variables without verifying ownership, allowing attackers to terminate active chatflow predictions for any user by providing known identifiers, which results in targeted service disruption.

Recommendations Update to version 3.1.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Offset

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers