Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Summary

The /api/v1/text-to-speech/generate endpoint is whitelisted (requires no authentication) and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential (OpenAI or ElevenLabs API key) to generate unlimited text-to-speech audio, incurring costs on the chatflow owner's account.

Details

The TTS generateTextToSpeech controller at packages/server/src/controllers/text-to-speech/index.ts:10-171 is whitelisted at packages/server/src/utils/constants.ts:41:

'/api/v1/text-to-speech/generate',

When a chatflowId is provided and the user is not authenticated (no req.user), the controller falls back to fetching the chatflow without workspace scoping:

// packages/server/src/controllers/text-to-speech/index.ts:36-42
if (workspaceId) {
    chatflow = await chatflowsService.getChatflowById(chatflowId, workspaceId)
} else {
    // Fallback: get workspaceId from chatflow when req.user.activeWorkspaceId is not set
    chatflow = await chatflowsService.getChatflowById(chatflowId)  // NO isPublic check
    workspaceId = chatflow.workspaceId
}

The getChatflowById function at packages/server/src/services/chatflows/index.ts:247-272 fetches any chatflow by ID when workspaceId is not provided:

const dbResponse = await appServer.AppDataSource.getRepository(ChatFlow).findOne({
    where: {
        id: chatflowId,
        ...(workspaceId ? { workspaceId } : {})  // No workspace filter when workspaceId is undefined
    }
})

The controller then extracts the TTS provider configuration from the chatflow: