IBM Security Bulletin: Broken Access Control in Langflow File Handling API

IBM Security Bulletin: Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files Vulnerability Summary The Langflow file handling API contains two unauthorized access vulnerabilities: 1. CVE-TBD-1: The endpoint does not require authentication, allowing unauthorized attackers to download images from any flow. 2. CVE-TBD-2: The endpoint requires authentication but fails to properly validate flow ownership, allowing any authenticated user to download files belonging to other users. Scope Affected Product: Langflow OSS Affected Versions: 1.0.0 - 1.8.4 Operating System: Windows, Linux, Mac OS Remediation Recommended Upgrade: Langflow v1.9.0 and later Workaround: None References Complete CVSS v3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgments Sergio Cabrera (nekr0sxx) Change History July 9, 2026: Initial release Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry standard designed to convey the severity of a vulnerability and help determine the urgency and priority of response. IBM provides CVSS scores “as is” and does not offer any express or implied warranties. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM periodically updates the component records in its product portfolio to reflect newly discovered vulnerabilities. IBM identifies previously unidentified packages regardless of their CVE date. The inclusion of an older CVE ID does not indicate that IBM used the referenced product since that date, nor does it indicate that IBM was aware of that vulnerability on that date. IBM brings vulnerabilities to the attention of customers as they become known to us. The “Affected Products and Versions” section of this IBM Security Bulletin is intended to list only IBM-supported and non-expired products and versions. Therefore, unsupported or extended support products and versions not referenced herein do not constitute grounds for IBM to determine that these products are unsupported. Referencing one or more unsupported versions in this security bulletin does not obligate IBM to fix any unsupported or extended support product or version.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Security Bulletin: Broken Access Control in Langflow File Handling API