IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
| Vendor | Product | Versions |
|---|---|---|
| ibm | langflow oss | 1.0.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | langflow | cert_advisory | 90% |
Loading…
Severity upgraded from HIGH to CRITICAL, affected versions extended to explicitly include 1.12.4, and added CWE-269 (Improper Privilege Management) to reflect the vulnerability's classification.
Initial creation
