CVE-2026-107366
CVE-2026-107366 · Langflow OSS Authorization Bypass Through User-Controlled Key
This page contains facts from public vulnerability sources. Check the original advisory before updating.
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
CVSS 8.3 · High · EPSS 0.2%
- Published
- Updated
Affected products and versions
langflow oss
- Versions
- ≥ 1.0.0, ≤ 1.12.4: Affected (semver)
No fix published