CVE-2026-4503CWE-639

Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint

High · published April 30, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
33.8
In the wild
Unconfirmed
What it is

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-30T20:48Z
EPSS history
Timeline
  • 30 APR 20:48Z
    Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint
    cvelistv5