IBM Langflow OSS versions 1.0.0 through 1.10.3 contain an authorization bypass in the MemoryComponent. The retrieve_messages and store_message functions filter only by session_id, neglecting to verify that the requesting user owns the referenced flow_id or user_id. An authenticated attacker can therefore inject a session_id collision to read or modify other users’ chat history. The flaw results in confidential data leakage rather than code execution or denial of service, and is associated with weaknesses in authentication trust and information disclosure (CWE‑285, CWE‑200).

The vulnerability affects IBM Langflow OSS releases 1.0.0 to 1.10.3, including the 1.10.3 build. Systems deployed with the default multi‑user configuration and LANGFLOW_AUTO_LOGIN set to False are impacted; single‑user or auto‑login environments are not vulnerable.

The CVSS score is 7.1, indicating a high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the deployment and a multi‑user setup with auto‑login disabled, which is the normal configuration for shared environments. Attackers can exploit the exposed API endpoints (/api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*) by creating a session_id collision, enabling cross‑user data retrieval without additional privileges.