CVE-2026-56277

Medium

Description

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts), independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS configuration (getCorsOptions()) and allows any webpage to make cross-origin requests that trigger TTS generation using stored credentials, enabling drive-by cross-origin credential abuse.

SeverityMedium

CVSS6.5

Exploit probability—

ProductFlowise

PublishedJun 30, 2026

First seenJun 30, 2026

Weakness typeCWE-346CWE-346

How to fix

Update

flowiseai flowise3.1.2 or later
flowise3.1.2 or later

Vendor advisories

github.com/FlowiseAI/Flowise/security/advisories/GHSA-m837-xvxr-vqwg

Affected products

Product	Affected versions	Fixed in
flowiseai flowise	v < 3.1.2	3.1.2
flowisenpm	v < 3.1.2	3.1.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.