IBM Langflow OSS CVE-2026-107366

Requires a valid authenticated account on the IBM Langflow OSS instance (any low-privilege user, PR:L) and a deployment with more than one user so cross-user messages/sessions exist to target. No non-default feature or special configuration is needed - the three affected message endpoints lack ownership verification in default deployments of versions 1.0.0 through 1.12.4. The attacker must know or enumerate the victim's message or session identifiers. Key limiting factors: authentication is mandatory (not remote-unauthenticated), and single-user/isolated instances have no other users' data to compromise, which substantially narrows realistic impact to shared or team Langflow environments.

This is a credible, above-average-priority vulnerability but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a low-complexity, network-reachable flaw requiring only a single low-privileged authenticated account, which fits the CWE-639 (IDOR / missing ownership check) root cause: three message endpoints perform no ownership verification, so any authenticated user can act on another user's data. The 8.3 base score is driven by C:H/I:H with A:L, reflecting conversation-session hijack (confidentiality), message overwrite / prompt injection (integrity), and bulk message deletion (limited availability). No EPSS score, no CISA KEV listing, and no public exploit were provided - so this is 'no public exploit identified at time of analysis', and there is no evidence of active exploitation; the risk is theoretical-but-easy rather than observed-in-the-wild. The practical limiter is the PR:L requirement plus the need for a multi-tenant deployment: a single-user Langflow instance has no cross-user data to attack, so real risk concentrates in shared/team Langflow deployments. The input tag 'Authentication Bypass' conflicts with the actual nature of the flaw - users must already be authenticated and the issue is an authorization (ownership) bypass per CWE-639; treat the tag as mislabeled, not as evidence of pre-auth access.

A low-privileged but legitimate user of a shared IBM Langflow OSS instance enumerates another user's message or session IDs and calls the unprotected message endpoints to overwrite that user's message content with an injected malicious prompt, delete their messages in bulk, or reassign the session ID to hijack the conversation. Because the attacker only needs a valid account and crafted API requests (AV:N/AC:L/UI:N), exploitation is straightforward in any multi-user deployment. No public proof-of-concept was identified at time of analysis.