Unauthenticated Credential Abuse in Flowise Text-to-Speech Feature

CVE-2026-73603

What is CVE-2026-73603?

An unvalidated access issue in the Flowise application allows unauthenticated attackers to misuse the text-to-speech endpoint. This vulnerability permits the abuse of private chatflow's text-to-speech credentials, enabling ill-intentioned users to generate unrestricted audio content. By supplying a valid chatflow UUID, attackers can leverage stored OpenAI or ElevenLabs API keys, which can lead to unexpected charges for the chatflow owner's account.

References