IBM Langflow OSS versions 1.0.0 through 1.8.4 contain broken access control vulnerabilities in its file handling API that allow unauthorized access to user files. The /api/v1/files/images/{flow_id}/{file_name} endpoint omits any authentication or authorization checks, enabling unauthenticated remote attackers to retrieve image files from any flow by specifying a valid flow_id and file_name. Additionally, the /api/v1/files/download/{flow_id}/{file_name} endpoint, while requiring authentication, fails to verify that the authenticated user owns the requested resource, allowing authenticated users to download files owned by others via an IDOR attack. Successful exploitation can lead to disclosure of sensitive data stored in private flows and breaks tenant isolation in multi‑user deployments.

Affected products are IBM Langflow OSS, with vulnerable releases ranging from 1.0.0 up to and including 1.8.4. No other IBM products or versions have been listed as affected by this vulnerability.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation; however, the presence of an unprotected endpoint means that unauthenticated attackers can use the service, so exploitation probability is non‑negligible in environments where the API is exposed. The issue is not yet listed in CISA’s KEV catalog. Attackers can target the vulnerable endpoints remotely over the network; an unauthenticated attacker only needs to supply a valid flow_id and file_name, while an authenticated attacker additionally can exploit the IDOR path by using arbitrary identifiers.