CVE-2026-112265: LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification

Q: Which versions should be considered affected?

LangBot through version 4.11.0 is identified as affected. The provided data does not identify a fixed version.

Q: What does an attacker need to exploit this issue?

An unauthenticated attacker needs to know a bot UUID and be able to POST fabricated Lark/Feishu event payloads. Exploitation is network-based and does not require user interaction or prior privileges.

Q: Can forged events be used to act as another user?

Yes. Fabricated im.message.receive_v1 or card.action.trigger events can drive the LLM pipeline, tools, and approvals as other users.

Published Oct 19, 2026

Updated

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receivev1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.

Affected Software

1 affected component

LangBot LangBot<=4.11.0

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions should be considered affected?

LangBot through version 4.11.0 is identified as affected. The provided data does not identify a fixed version.

What does an attacker need to exploit this issue?

An unauthenticated attacker needs to know a bot UUID and be able to POST fabricated Lark/Feishu event payloads. Exploitation is network-based and does not require user interaction or prior privileges.

Can forged events be used to act as another user?

Yes. Fabricated im.message.receive_v1 or card.action.trigger events can drive the LLM pipeline, tools, and approvals as other users.

CVE-2026-112265: LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification

Affected Software

Event History

Frequently Asked Questions

Which versions should be considered affected?

What does an attacker need to exploit this issue?

Can forged events be used to act as another user?

Company

Resources

Contact

Frequently Asked Questions

Which versions should be considered affected?

What does an attacker need to exploit this issue?

Can forged events be used to act as another user?