IBM Langflow Desktop versions 1.0.0 through 1.8.4 contain an IDOR vulnerability that enables an unauthenticated user to retrieve images belonging to other accounts. The flaw arises from a user-controlled key that bypasses access controls, resulting in a direct exposure of private image data. The CVSS score of 7.5 indicates a high severity, reflecting the significant confidentiality impact of this vulnerability.

The affected products are IBM Langflow Desktop, specifically all releases ranging from 1.0.0 up to and including 1.8.4. The associated CPE data confirms that version 1.0.0 and 1.8.4 are impacted, but the same vulnerability exists in all intermediate releases. Users running any of these versions should assess their deployment to confirm exposure.

The vulnerability can be exploited by simply issuing a request to the image download endpoint with an appropriate key; authentication is not required. This makes it a readily exploitable risk, especially for publicly accessible instances or environments where endpoints are exposed to the internet. Although an EPSS score is not available, the high CVSS rating and the lack of a KEV listing suggest that the risk is non‑negligible and should be mitigated promptly.