CVE-2026-73603 describes a missing authorization vulnerability in Flowise before version 3.1.4. The unauthenticated text-to-speech endpoint does not validate chatflow visibility, enabling attackers without authentication to abuse private chatflow TTS credentials. By providing a valid chatflow UUID, attackers can generate unlimited text-to-speech audio leveraging stored API keys from OpenAI or ElevenLabs, which may lead to unauthorized usage and financial impact on the account owner.

The vulnerability allows unauthenticated attackers to generate unlimited text-to-speech audio using private API credentials stored in chatflows. This can lead to unauthorized consumption of API resources and financial costs charged to the legitimate chatflow owners. There is no indication of data disclosure or system compromise beyond abuse of TTS functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the text-to-speech endpoint or implement additional authorization checks to validate chatflow visibility. Monitor usage of API keys for unusual activity to detect potential abuse.