Langflow fixes IDOR letting authenticated users execute other users’ flows

Langflow disclosed a high-impact insecure direct object reference vulnerability, tracked as GHSA-qrpv-q767-xqq2, that allowed any authenticated user on affected deployments to access and execute another user’s flow through the /api/v1/responses endpoint. The flaw affected pip package versions earlier than 1.9.1 and stemmed from backend logic that resolved flows by UUID without verifying ownership, enabling an attacker to submit a victim’s flow UUID and receive the resulting output. Successful exploitation could expose sensitive data processed by the victim’s flow and consume the victim’s compute resources.

The fix, merged in PR #12832, added ownership checks for both UUID- and endpoint-name-based flow lookups and changed unauthorized access handling to return 404 instead of 403 to avoid revealing whether a target flow exists. Langflow also hardened related routes, including /api/v1/run, /api/v1/run/session, and /api/v1/run/advanced, to close similar unscoped dependency patterns, and added regression tests covering cross-user access, malformed user_id inputs, and the reported proof of concept. Users are advised to upgrade to 1.9.1 or later.