Executive brief
Flowise is a visual AI agent builder that integrates with external APIs like OpenAI and ElevenLabs for text-to-speech generation. The text-to-speech endpoint is publicly accessible without authentication and accepts arbitrary stored credential IDs from client requests, allowing attackers to use victim API keys to generate speech content and exhaust API credits at the victim's expense.
Technical details
The vulnerability exists in the POST /api/v1/text-to-speech/generate endpoint (packages/server/src/controllers/text-to-speech/index.ts:58-64), which is whitelisted in WHITELIST_URLS and therefore bypasses authentication. When no chatflowId is provided, the endpoint accepts a credentialId directly from the request body and uses it to decrypt and load stored API credentials. An attacker can send a POST request with an arbitrary credentialId to call the endpoint without authentication, and the server will process the request and decrypt the victim's stored credential. The endpoint does not validate that the credential ID belongs to the requesting user or their chatflow. By repeatedly calling this endpoint with different credential IDs discovered via other means (credential enumeration), an attacker can consume victim API credits. The fix removes the endpoint from the whitelist or validates that any credentialId matches the chatflow's TTS configuration. Patched in version 3.1.0.
Affected products
- FlowiseAI Flowise <= 3.0.13
Timeline
- 2026-04-17: disclosed: Advisory published
- 2026-04-15: patched: Patched in version 3.1.0