7.5Hoch
CVE-2026-4503Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint
Beschreibung
IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.
Schwachstellentyp (CWE):
CWE-639
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| IBM | Langflow Desktop | 1.0.0 – ≤ 1.8.4 | |
| langflow | langflow desktop | 1.0.0 – ≤ 1.8.4 |
Referenzen und Patches
- https://www.ibm.com/support/pages/node/7271099 vendor-advisorypatchVendor Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:langflow:langflow_desktop:*:*:*:*:*:*:*:*≥ 1.0.0 ≤ 1.8.4