CVE-2026-7787CWE-639

Unauthenticated Session History Access via Public Flow Execution

High · published June 11, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00438 · 37.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-11T14:41Z
EPSS history
Timeline
  • 11 JUN 14:41Z
    Unauthenticated Session History Access via Public Flow Execution
    cvelistv5