The vulnerability is located in the \/api\/v1\/files\/images\/{flow_id}\/{file_name} endpoint of Langflow. Authentication and authorization checks are missing; any unauthenticated user can request a file by supplying the flow ID and file name. This permits the disclosure of images that may contain sensitive or confidential visual information, thereby infringing on confidentiality. The weakness corresponds to unauthorized access to protected resources.

All installations of Langflow may be affected because version information is not specified. Any instance that includes the described endpoint without proper authentication is susceptible until the issue is addressed.

The CVSS score of 6.3 indicates moderate severity; however, exploitation requires no authentication and can be performed remotely over the network, making it fairly easy to exploit. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Operators should consider this a moderate risk that warrants timely mitigation.