IBM Langflow OSS versions 1.0.0 through 1.10.2 contain an authorization failure that allows an authenticated attacker to gain control of the voice‑mode WebSocket endpoint. The attacker can inject arbitrary messages into workflow histories and read sensitive data that should be protected. The weakness is a classic example of insufficient authorization (CWE‑639), which damages the confidentiality and integrity of the system but does not grant arbitrary code execution.

The vulnerability affects IBM’s open‑source Langflow OSS product in the version range 1.0.0 to 1.10.2. Users running any of these releases on any platform are at risk if they enable the voice‑mode WebSocket functionality. The fix is available in Langflow OSS 1.10.3, which is the first release to address the missing access control.

The CVSS score of 4.9 indicates a moderate risk level. EPSS data is not available, so the precise likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attacks would require the attacker to be authenticated to the application; the missing authorization check is performed after authentication, enabling the attacker to hijack the WebSocket channel and inject or read data.