{"id":"EUVD-2026-25298","enisaUuid":"e9a5ae6a-fe3d-319a-aa3b-7a8c9d224c02","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt the stored credential (e.g., OpenAI or ElevenLabs API key) and generate speech. This vulnerability is fixed in 3.1.0.","datePublished":"Apr 23, 2026, 7:53:15 PM","dateUpdated":"Apr 23, 2026, 8:18:05 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5fw2-mwhh-9947\n","aliases":"CVE-2026-41279\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"b4d43ffe-5990-3c15-ab3e-d11a0e67e0cc","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"enisaIdVendor":[{"id":"4e34abf0-38c9-3b0d-aabe-ef560f5ef26b","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"d8201f8a-f4d9-3023-93d5-ac10a82f0fd2","vulnerability":{"id":"CVE-2026-41279","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt the stored credential (e.g., OpenAI or ElevenLabs API key) and generate speech. This vulnerability is fixed in 3.1.0.","datePublished":"Apr 23, 2026, 7:53:15 PM","dateUpdated":"Apr 23, 2026, 8:18:05 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5fw2-mwhh-9947\n","enisa_id":"EUVD-2026-25298\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"7e450b8c-b35e-39ab-9d83-f8e17a1e4a4d","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"vulnerabilityVendor":[{"id":"717091e1-18b6-3d2f-b268-cb7ec180a6e7","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}