PT-2026-59227 · Pypi · Langflow-Base
Published
2026-07-13
·
Updated
2026-07-13
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Vulnerability
IDOR in GET/PATCH/DELETE /api/v1/flow/{flow id}
The
read flow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTO LOGIN setting to decide whether to filter by user id. When AUTO LOGIN was False (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it.This exposed any authenticated user to:
- Read any other user's flow, including embedded plaintext API keys
- Modify the logic of another user's AI agents
- Delete flows belonging to other users
The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with
user id = NULL) under auto-login mode, but inadvertently left the authenticated path without an ownership filter.Fix (PR #8956)
The fix removes the
AUTO LOGIN conditional entirely and unconditionally scopes the query to the requesting user:diff
- auth settings = settings service.auth settings
- stmt = select(Flow).where(Flow.id == flow id)
- if auth settings.AUTO LOGIN:
- stmt = stmt.where(
- (Flow.user id == user id) | (Flow.user id == None) # noqa: E711
- )
+ stmt = select(Flow).where(Flow.id == flow id).where(Flow.user id == user id)All three operations — read, update, and delete — route through
read flow, so the single change covers the full attack surface. A cross-user isolation test (test read flows user isolation) was added to prevent regression.Acknowledgements
Langflow thanks the security researcher who responsibly disclosed this vulnerability:
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Langflow-Base