Executive brief
Flowise is an open-source platform for building conversational AI applications. The text-to-speech endpoint can be accessed without authentication and fails to verify whether a chatflow is private, allowing attackers to abuse stored TTS API credentials (OpenAI, ElevenLabs) belonging to other users. An attacker who discovers a chatflow ID can generate unlimited audio at the victim's cost, potentially causing significant financial damage and service disruption.
Technical details
The vulnerability is a broken access control issue in the /api/v1/text-to-speech/generate endpoint, which is whitelisted to require no authentication. When an unauthenticated request provides a chatflowId, the controller retrieves the chatflow without validating workspace scope or the isPublic flag. The getChatflowById function fetches any chatflow by ID when workspaceId is undefined, and the controller then extracts the TTS provider credentials (API keys) from the retrieved chatflow's configuration and uses them to make API calls on behalf of the attacker. An attacker with knowledge of a valid chatflow UUID can invoke the endpoint with arbitrary text to generate audio using the target chatflow's credentials, incurring costs and potentially exhausting API quotas. The vulnerability affects chatflows of any visibility level, including those explicitly marked private. A patch is available in version 3.1.4 that adds an isPublic check before allowing unauthenticated TTS generation.
Affected products
- Flowise Flowise <= 3.1.3
Timeline
- 2026-07-27: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched: Fixed in version 3.1.4