7.5Alta
CVE-2026-4503Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint
Descripción
IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.
Debilidad (CWE):
CWE-639
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| IBM | Langflow Desktop | 1.0.0 – ≤ 1.8.4 | |
| langflow | langflow desktop | 1.0.0 – ≤ 1.8.4 |
Referencias y parches
- https://www.ibm.com/support/pages/node/7271099 vendor-advisorypatchVendor Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:langflow:langflow_desktop:*:*:*:*:*:*:*:*≥ 1.0.0 ≤ 1.8.4