CVE-2026-90535 is a missing authorization flaw in Flowise, the open source tool for building LLM chatflows. Before version 3.1.4, an unauthenticated request to the text-to-speech abort endpoint can end another user's running prediction. NVD scores it High (7.5). Upgrade the npm package flowise to 3.1.4.
What's affected
The GitHub advisory lists the npm package flowise at versions up to and including 3.1.3 as affected, with 3.1.4 as the patched release. The NVD record says the same thing in different words: all versions before 3.1.4.
The weakness is CWE-862, missing authorization. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so it is reachable over the network with no login and affects availability only. It does not expose data or let an attacker change anything.
The two sources disagree on how serious it is. The NVD record scores it 7.5 High. The Flowise GitHub advisory labels it Moderate, and the VulnCheck page shows a CVSS v4 score of 6.3 (medium). Different scoring versions and different assumptions explain the gap. Plan around the higher number if your instance is exposed to the internet.
How to check if you're exposed
Find out which version you run. For an npm install, run this in the project or global prefix:
npm ls flowise
npm ls -g flowise
If you run the Docker image, check the image tag you deployed and compare it with 3.1.4. Anything at 3.1.3 or earlier is in range.
Also ask whether the instance is reachable from outside your network. The advisory says the abort route is on the list of paths that need no authentication, so a reverse proxy rule or network restriction in front of Flowise is the only thing between an outsider and the endpoint on a vulnerable build.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Upgrade Flowise to 3.1.4 or later and redeploy.
- Until you can upgrade, restrict who can reach the Flowise API with a reverse proxy, VPN or allow list. Do not leave a public chatflow instance open to the whole internet.
- Watch for chat sessions that end early with no user action. That is the visible effect described in the advisory.
- Record the version in your inventory so the next advisory is a quick lookup.
Why it matters
The handler takes a chatflow identifier and a chat identifier from the request body and uses them to cancel the matching in-progress prediction. It never checks that the caller owns that session, and the route does not require a login. That is a textbook missing authorization check.
The attacker needs to know a valid chatflow ID and chat ID, which limits casual abuse, but those values can leak through shared links or logs. The result is targeted disruption of live conversations rather than a full outage. The record's KEV flag is false and none of the sources we read report exploitation in the wild.
Quick check
Does this flaw expose chat contents?
No. The record and advisory describe an availability impact only. The caller can end a running prediction but the sources do not describe reading or changing data.
Is 3.1.4 the only fix?
The advisory names 3.1.4 as the patched version. Check the Flowise release notes if you need to know about anything newer.
Sources
Last reviewed: 18 October 2026.
