Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: FlowiseAI Flowise 3.1.4 Clear all filters
TI-2026-61549 CVE-2026-90535 · GHSA-4xpg-6vjv-3v64

Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Priority MEDIUM 61

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00482 Published 2026-09-12 Fixed in 3.1.4 CWE-862
TI-2026-61547 CVE-2026-90533 · GHSA-hwr2-69f4-g9h6

Flowise before 3.1.4 Broken Access Control via organizationuser

Priority MEDIUM 60

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00335 Published 2026-09-12 Fixed in 3.1.4 CWE-862