CVE-2026-73603
CVE-2026-73603 · Flowise before 3.1.4 Credential Abuse via Text-to-Speech
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.
CVSS 6.3 · Moyenne · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node