The vulnerability originates in the /logs and /logs-stream endpoints of Langflow’s log router. The endpoints perform basic authentication with the current user but do not enforce any privileged checks, meaning that any authenticated user can invoke them. As a result, a user can download the entire application log buffer, potentially exposing sensitive data such as stack traces, configuration strings, or authentication tokens. This exposure directly violates confidentiality and is identified as a Missing Authorization weakness (CWE‑862).

The affected product is the Langflow‑AI Langflow application. No specific version information is provided in the advisory, so all installations that use the vulnerable log‑router endpoints are presumed to be impacted. Administrators should verify whether the log endpoints are enabled in their deployment and consider which user accounts have access.

The CVSS score of 6.5 indicates a moderate severity. With no EPSS score provided and the issue absent from the CISA KEV catalog, the likelihood of widespread exploitation is uncertain; however, the attack condition only requires valid credentials. An attacker who obtains or compromises any user account can read all logs, making the vulnerability straightforward to exploit for anyone who can authenticate.