SB20260727378 - Unauthenticated credential abuse via Text-to-Speech endpoint in Flowise

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260727378

SB20260727378 - Unauthenticated credential abuse via Text-to-Speech endpoint in Flowise

Published: July 27, 2026

Security Bulletin ID SB20260727378
CSH Severity
Medium
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause unauthorized use of private chatflow text-to-speech credentials.

The vulnerability exists due to missing authorization in the /api/v1/text-to-speech/generate endpoint and generateTextToSpeech controller when handling unauthenticated text-to-speech generation requests with an arbitrary chatflowId. A remote attacker can send a specially crafted request referencing a private chatflow UUID to cause unauthorized use of private chatflow text-to-speech credentials.

The issue affects private chatflows with text-to-speech configured, and the stored provider credentials are used on behalf of the request without being directly exposed.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References