Langflow IDOR Vulnerability Confirmed: Upgrade and Review Access Controls
A confirmed insecure direct object reference (IDOR) vulnerability in the Langflow package allows authenticated attackers to access another user's flow by specifying the victim's flow ID in the request. Users of Langflow are affected.
What happened
The Langflow package contains an IDOR vulnerability tracked as GHSA-QRPV-Q767-XQQ2. This vulnerability allows authenticated attackers to access another user's flow by specifying the victim's flow ID in a request to the `/api/v1/responses` endpoint. This issue has been confirmed by multiple independent sources.
To assess your exposure, check if your application uses Langflow and makes requests to the `/api/v1/responses` endpoint. If so, you may be vulnerable. The recommended action is to upgrade to the latest version of Langflow that includes the fix for this vulnerability. Additionally, review and strengthen access controls for the affected endpoint.
For more details, consult the primary sources: [GHSA-ccv6-r384-xp75](https://github.com/advisories/GHSA-ccv6-r384-xp75) and [GHSA-qrpv-q767-xqq2](https://github.com/advisories/GHSA-qrpv-q767-xqq2).
How 0Day mitigates this
langflow is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.