CVE-2026-56277: Flowise TTS Endpoint CORS Bypass – Cross-Origin Credential Abuse

Technical summary

The vulnerability resides in the TTS generation endpoint (packages/server/src/controllers/text-to-speech/index.ts) where the Access-Control-Allow-Origin header is unconditionally set to a wildcard (*). This hardcoded value overrides Flowise's restrictive default CORS policy (getCorsOptions()), which would otherwise validate and restrict cross-origin requests. The lack of origin validation, combined with the application's reliance on cookie-based authentication, allows unauthenticated third-party sites to make authenticated cross-origin requests to generate TTS output. This violates CWE-346 (Origin Validation Error) by failing to properly validate request origins before permitting cross-origin resource access.

Business impact

Organizations deploying Flowise in environments where users may visit untrusted websites face risk of unauthorized TTS generation, which could increase cloud API costs, degrade service quality through resource exhaustion, or be used to probe for sensitive information embedded in generated speech. While the CVSS severity is medium, the attack requires no user interaction beyond normal browsing and leverages the trust relationship between Flowise and the user's browser. For enterprises integrating Flowise into customer-facing or internal AI workflows, this could enable social engineering or competitive intelligence gathering via speech synthesis without direct user consent.

Affected systems

Flowise versions before 3.1.2 are affected. The vulnerability is specific to the TTS generation endpoint and does not impact other Flowise functionality. Organizations running Flowise 3.1.2 or later are unaffected. The flaw is present in the server-side controller logic and affects all deployments regardless of underlying operating system or infrastructure.

Exploitability

Exploitation is straightforward and requires no special privileges. An attacker needs only to host a malicious webpage containing a cross-origin request to the TTS endpoint (e.g., via a fetch() or <img> tag) and trick a logged-in Flowise user into visiting that page. The attack vector is network-based, exploits no complex attack chains, and succeeds automatically without user interaction beyond browsing. The lack of authentication checks on the CORS header itself (versus the credential transmission) makes this a relatively low-friction attack. However, the attack does require the victim to maintain an active authenticated session—unauthenticated users cannot trigger TTS generation.

Remediation

Upgrade Flowise to version 3.1.2 or later immediately. The patch corrects the CORS header behavior to respect the server's configured getCorsOptions() policy rather than hardcoding a wildcard. Organizations unable to upgrade immediately should implement a Web Application Firewall (WAF) rule to strip or validate the Access-Control-Allow-Origin header on the /text-to-speech endpoint, or restrict TTS endpoint access to known trusted origins via reverse proxy configuration. Additionally, monitor for unusual TTS request patterns that may indicate exploitation attempts.

Patch guidance

Upgrade to Flowise 3.1.2 or later. The fix removes the hardcoded wildcard and aligns the TTS endpoint's CORS behavior with the application's default restrictive policy. Verify the upgrade by confirming the TTS endpoint no longer returns Access-Control-Allow-Origin: * in cross-origin requests. After patching, test that authenticated TTS requests from legitimate origins continue to function while cross-origin requests from unauthorized origins are correctly rejected.

Detection guidance

Monitor HTTP responses from the /text-to-speech endpoint for the presence of Access-Control-Allow-Origin: * headers paired with cross-origin request origins. Log and alert on unexpected TTS generation requests originating from external referrer headers or from API calls lacking typical internal user-agent patterns. Examine access logs for TTS requests from users not known to use the TTS feature. Implement browser-based detection by monitoring for any <script> or fetch() calls targeting the TTS endpoint from pages outside your organization's domain. Network-based detection can flag outbound TTS requests from internal hosts to Flowise that correlate with visits to external websites.

Why prioritize this

While assigned a medium CVSS score, this vulnerability merits prompt patching because it exploits a fundamental trust boundary violation—user authentication state—and requires no user interaction beyond normal web browsing. The attack surface is broad (any website) and the impact, though limited to TTS resource abuse, compounds in multi-tenant or high-volume environments. The fix is straightforward and low-risk, making it a high-value remediation effort relative to effort required.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects low attack complexity, network-based vector, and absence of user interaction; however, the impact is limited to confidentiality and integrity of the TTS generation process (not system compromise). The scope is unchanged (same authorization boundary). The score does not account for organizational context—businesses with public-facing TTS features or sensitive speech synthesis workflows may warrant elevated internal risk ratings.

Frequently asked questions