In breve
- CVE-2026-56277 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda flowise (flowiseai), flowise.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.18%, superiore al 7.5% delle vulnerabilità.
- Correzione: aggiornare a 3.1.2 o successiva.
| Package | Affected versions | Patched versions |
|---|
| flowise | < 3.1.2
| 3.1.2
|
| flowise npm | < 3.1.2
| 3.1.2
|
Description
Summary
The TTS generation endpoint sets Access-Control-Allow-Origin: * as a hardcoded response header, independent of the server's CORS configuration. This enables any webpage to make cross-origin requests to generate speech using stored credentials.
Root Cause
// packages/server/src/controllers/text-to-speech/index.ts:83
res.setHeader('Access-Control-Allow-Origin', '*')
res.setHeader('Access-Control-Allow-Headers', 'Cache-Control')
Impact
- Cross-origin credential abuse — any webpage can trigger TTS using stored credentials
- Bypasses the server's CORS policy (
getCorsOptions()) which is otherwise restrictive by default
- Combined with Finding 3 (TTS credential abuse), enables drive-by credential abuse via malicious webpages
Suggested Fix
Remove the hardcoded CORS wildcard and let the server's CORS middleware handle the headers:
// Remove these lines:
// res.setHeader('Access-Control-Allow-Origin', '*')
// res.setHeader('Access-Control-Allow-Headers', 'Cache-Control')
References
packages/server/src/controllers/text-to-speech/index.ts line 83
NVD description
Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts), independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS configuration (getCorsOptions()) and allows any webpage to make cross-origin requests that trigger TTS generation using stored credentials, enabling drive-by cross-origin credential abuse.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free