Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2026-107366

Langflow OSS Authorization Bypass Through User-Controlled Key

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM Langflow OSS

  • 1.0.0 to ≤ 1.12.4affected

References