CVE Feed

    Dashboard / CVE / CVE-2026-73603

    CVE-2026-73603

    Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.

    Published:Aug 13, 2026
    Last Modified:Sep 4, 2026
    EPS:Aug 13, 2026
    EPSS Score:0.00317
    CVSS Score:5.3

    Affected Products

    Vendor
    Flowiseai
    Product
    Flowise

    Exploits

    https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8gj2-2cvc-6xx7https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8gj2-2cvc-6xx7

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-73604 (CVSS 7.1) — Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/…
    CVE-2026-73602 (CVSS 9) — Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authent…
    CVE-2026-73601 (CVSS 9) — Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM…
    CVE-2026-73488 (CVSS 6) — Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/org…
    CVE-2026-73487 (CVSS 9) — Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that …
    CVE-2026-73486 (CVSS 9) — Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter t…
    CVE-2026-73485 (CVSS 9) — Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenti…
    CVE-2026-73484 (CVSS 8.6) — Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block nat…
    CVE-2026-73483 (CVSS 9.4) — Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@fl…
    CVE-2026-71962 (CVSS 8.7) — Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High