Flowise missing authorization in Text-to-Speech endpoint

Executive brief

Flowise, an open-source tool for building LLM applications, contains a vulnerability that allows unauthorized users to use the text-to-speech (TTS) features of private chatflows. By exploiting this, an attacker can generate audio using the owner's paid API keys (such as OpenAI or ElevenLabs), leading to unexpected financial costs and potential service exhaustion. This affects both public and private chatflows if an attacker knows the specific ID of the chatflow.

Technical details

The `/api/v1/text-to-speech/generate` endpoint in Flowise is whitelisted for unauthenticated access but fails to verify if a requested `chatflowId` belongs to a public chatflow. When a request is made without authentication, the `generateTextToSpeech` controller fetches the chatflow without workspace scoping or visibility checks. It then extracts and uses the configured TTS credentials (e.g., OpenAI or ElevenLabs API keys) to process the request. An attacker with knowledge of a chatflow UUID can indirectly use these private credentials to generate unlimited audio, incurring costs for the owner and potentially exhausting API quotas. This has been patched in version 3.1.4.

Affected products

• FlowiseAI flowise <= 3.1.3

Timeline

• 2026-07-27: disclosed
• 2026-08-04: advisory
• 2026-08-04: patched: Fixed in version 3.1.4

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D