CVE-2026-7787 HIGH

CVE-2026-7787: Unauthenticated Session History Access via Public Flow Execution

Vendor Ibm

Product Langflow OSS

Weakness CWE-639 · IDOR

Published June 11, 2026

Last update June 11, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

Key dates

02Disclosure timeline

June 11, 2026 CVE published

June 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-7787 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2025-3625 Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action CVE-2026-4630 Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference CVE-2026-47266 Formie: Unauthenticated front-end submission editing can overwrite existing submissions CVE-2026-42572 Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds` CVE-2026-8839 MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints