CVE-2026-90535: Flowise IDOR — HIGH

CISO Take

Flowise's /api/v1/text-to-speech/abort endpoint accepts a chatflowId and chatId without verifying the caller owns that session, so anyone who can reach the API can terminate another user's active chatflow prediction on demand. There's no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, but the attack requires zero authentication, zero privileges, and only trivial reconnaissance — chat identifiers are frequently exposed client-side in embedded Flowise widgets. Because Flowise is a widely deployed low-code framework for building production LLM agents and chatbots, this can be used to selectively disrupt customer-facing AI interactions or automated business workflows built on it, with no forensic trail beyond an API call. Upgrade to Flowise 3.1.4 or later immediately; until patched, restrict network access to the Flowise API to trusted origins and monitor abort-endpoint traffic for calls referencing chatflow/chat IDs not tied to the requester's own session.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

No CVSS vector or EPSS score is published, and the flaw is not in CISA KEV or associated with a known scanner template or public PoC, which keeps formal severity metrics low. However, the exploit itself is trivial: it is an unauthenticated, single-request IDOR-style broken access control issue (CWE-862) requiring no privileges or user interaction — only knowledge of a valid chatflowId/chatId pair, which may be discoverable via exposed embeds, logs, or brute-forcing sequential/guessable identifiers. The realistic risk is targeted service disruption rather than data compromise, but the near-zero barrier to exploitation means any exposed, unpatched Flowise instance should be treated as immediately exploitable.

How does the attack unfold?

Reconnaissance

Attacker locates a public-facing Flowise instance and obtains a valid chatflowId/chatId pair, often exposed via embedded chatbot widget code.

AML.T0049

Exploitation

Attacker sends an unauthenticated POST request to /api/v1/text-to-speech/abort with the target chatflowId and chatId, with no ownership check blocking it.

AML.T0029

Impact

The victim's active chatflow prediction is terminated mid-execution, causing failed or degraded AI responses for legitimate users or business processes.

AML.T0029

Reconnaissance

Attacker locates a public-facing Flowise instance and obtains a valid chatflowId/chatId pair, often exposed via embedded chatbot widget code.

AML.T0049

Exploitation

Attacker sends an unauthenticated POST request to /api/v1/text-to-speech/abort with the target chatflowId and chatId, with no ownership check blocking it.

AML.T0029

Impact

The victim's active chatflow prediction is terminated mid-execution, causing failed or degraded AI responses for legitimate users or business processes.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Upgrade Flowise to version 3.1.4 or later, which is expected to add ownership verification on the abort endpoint per the GitHub Security Advisory (GHSA-xhxx-56g3-mx2r). Until patched, avoid exposing the Flowise API directly to untrusted networks — place it behind an authenticated reverse proxy or API gateway. Audit how chatflowId/chatId values are generated and surfaced (e.g., in embedded widget JavaScript) to reduce predictability and exposure. Add monitoring/alerting on the /api/v1/text-to-speech/abort endpoint for high call volumes or calls referencing IDs not associated with the requester's own active session, and review Flowise access logs retroactively for suspicious abort patterns.

How is it classified?

Auth Bypass DoS Agent API AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM04 - Model Denial of Service

Frequently Asked Questions

What is CVE-2026-90535?

Flowise's /api/v1/text-to-speech/abort endpoint accepts a chatflowId and chatId without verifying the caller owns that session, so anyone who can reach the API can terminate another user's active chatflow prediction on demand. There's no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, but the attack requires zero authentication, zero privileges, and only trivial reconnaissance — chat identifiers are frequently exposed client-side in embedded Flowise widgets. Because Flowise is a widely deployed low-code framework for building production LLM agents and chatbots, this can be used to selectively disrupt customer-facing AI interactions or automated business workflows built on it, with no forensic trail beyond an API call. Upgrade to Flowise 3.1.4 or later immediately; until patched, restrict network access to the Flowise API to trusted origins and monitor abort-endpoint traffic for calls referencing chatflow/chat IDs not tied to the requester's own session.

Is CVE-2026-90535 actively exploited?

No confirmed active exploitation of CVE-2026-90535 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-90535?

Upgrade Flowise to version 3.1.4 or later, which is expected to add ownership verification on the abort endpoint per the GitHub Security Advisory (GHSA-xhxx-56g3-mx2r). Until patched, avoid exposing the Flowise API directly to untrusted networks — place it behind an authenticated reverse proxy or API gateway. Audit how chatflowId/chatId values are generated and surfaced (e.g., in embedded widget JavaScript) to reduce predictability and exposure. Add monitoring/alerting on the /api/v1/text-to-speech/abort endpoint for high call volumes or calls referencing IDs not associated with the requester's own active session, and review Flowise access logs retroactively for suspicious abort patterns.

What systems are affected by CVE-2026-90535?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM chat interfaces, production AI agents/chatbots.

What is the CVSS score for CVE-2026-90535?

CVE-2026-90535 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM chat interfacesproduction AI agents/chatbots

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.

Exploitation Scenario

An attacker identifies a publicly reachable Flowise instance — for example, one embedding a customer-facing chatbot widget on a company website — and extracts the chatflowId from the page source or network requests. By observing or guessing active chatId values (e.g., via predictable session patterns or by triggering their own session and inferring adjacent IDs), the attacker scripts repeated unauthenticated POST requests to /api/v1/text-to-speech/abort targeting other users' active sessions. Each request silently kills an in-progress AI response, degrading the chatbot's reliability for legitimate customers or disrupting an automated workflow at a chosen moment, with no authentication bypass artifacts to trace beyond ordinary API logs.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.