Missing Authorization in Flowise - CVE-2026-73603
Published: July 27, 2026 / Updated: September 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause unauthorized use of private chatflow text-to-speech credentials.
The vulnerability exists due to missing authorization in the /api/v1/text-to-speech/generate endpoint and generateTextToSpeech controller when handling unauthenticated text-to-speech generation requests with an arbitrary chatflowId. A remote attacker can send a specially crafted request referencing a private chatflow UUID to cause unauthorized use of private chatflow text-to-speech credentials.
The issue affects private chatflows with text-to-speech configured, and the stored provider credentials are used on behalf of the request without being directly exposed.