CVE-2026-107366 HIGH

CVE-2026-107366: Langflow OSS Authorization Bypass Through User-Controlled Key

Vendor Ibm

Product Langflow OSS

Weakness CWE-639 · IDOR

Published October 19, 2026

Last update October 20, 2026

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

Key dates

02Disclosure timeline

October 19, 2026 CVE published

October 20, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-107366 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html AskarLabs — CWE-639 write-up Authorization Bypass Through User-Controlled Key

Related vulnerabilities

04Related CVE

CVE-2026-57341 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-9188 Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter CVE-2026-57680 WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-28155 WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability