Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

SummaryBefore Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:- POST /api/v1/build/flowid/vertices retrieveverticesorder- POST /api/v1/build/flowid/vertices/vertexid buildvertexAny...

PYSEC-2026-4238 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

PYSEC-2026-4234 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

GHSA-GH98-4PHW-6FMW Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

CVE-2026-105698

Langflow (versions 1.0.0 through 1.10.0) is vulnerable to cross-user flow access and unauthorized vertex execution due to a missing ownership check in deprecated handlers. Specifically, the POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} endpoints faile...

CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...

CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...

PYSEC-2026-2570 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Vulnerability IDOR in GET/PATCH/DELETE /api/v1/flow/flowid The readflow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTOLOGIN setting to decide whether to filter by userid. When AUTOLOGIN was False i.e., authentication was enabled, neither branch enforced an ownership chec...

Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request...

CVE-2026-55255

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference IDOR vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in...

PT-2022-27786

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2022.10.4 authentik versions prior to 2022.11.4 Description The issue allows any authenticated user to create an arbitrary number of accounts through the default flows, which can circumvent policies where it is...

What is User Flow and how to make one?

By Owais Sultan User Flow is a technique that allows you to quickly map the entire flow of screens on your… This is a post from HackRead.com Read the original post: What is User Flow and how to make one?...

5 must-try user flow diagramming tools for UX designing 2021

By Uzair Amir Want to come up with a smooth user flow diagram for your website or app? Then find out about the best user flow and flowchart creation tools in this guide. This is a post from HackRead.com Read the original post: 5 must-try user flow diagramming tools for UX designing 2021...