CVE-2026-73603: Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing atta

Flowise versions before 3.1.4 have a security flaw in their text-to-speech endpoint that doesn't properly check if users should have access to private chatflows (the conversation flows that power the AI). This means attackers can use someone else's private chatflow without logging in, and generate unlimited audio files using that chatflow owner's paid API keys (like OpenAI or ElevenLabs), costing the owner money.