IBM Langflow OSS versions 1.0.0 through 1.12.4 contain three message endpoints that fail to verify message ownership. An authenticated user can delete any other user's messages, replace message content to inject malicious prompts, or hijack a conversation session by reassigning its session ID. These capabilities allow an attacker to erase user data, inject harmful content into prompts, and take control of sessions, thereby compromising confidentiality, integrity, and availability of the application.

These issues affect IBM Langflow OSS 1.0.0 through 1.12.4. The vulnerability was fixed in version 1.9.0, with subsequent fixes for related CVEs in 1.11.2 and 1.11.5, and the current release 1.12.5 includes all fixes. Any deployment using a vulnerable version, including those with MCP stdio enabled, is at risk.

The CVSS score of 8.3 indicates high severity. The EPSS score is not available, so the exploitation probability cannot be quantified; however, the vulnerability requires only authentication and leverages existing endpoints, suggesting an internal attacker or a compromised account could exploit it. The impact is not listed in the KEV catalog. The lack of ownership checks and the ability to alter session identifiers make this a potentially significant threat for any organization using these Langflow OSS versions.