IBM's Langflow OSS implementation in versions 1.0.0 through 1.11.5 has a flaw that lets a logged‑in attacker read files that belong to other users. The issue arises in the File/Read File component when the run endpoint accepts arbitrary storage paths using user or flow identifiers without checking that the requester owns those resources. As a result, a low‑privileged authenticated user could construct a special file path to another user's storage namespace and the backend would return the contents of the referenced file, bypassing the intended authorization checks and exposing sensitive data.

IBM Langflow OSS is affected, specifically all releases from 1.0.0 up to and including 1.11.5. The vulnerability is present in the components that handle file reading in these versions.

The CVSS score of 6.5 marks this as a medium‑severity issue, and the EPSS score is not available so the exploitation probability cannot be precisely quantified. It is not listed in the CISA KEV catalog, indicating no known widespread exploitation. An attacker requires authenticated access and the ability to hit the /api/v1/run/advanced/{flow_id} endpoint. With that, a crafted component input can reference an arbitrary file path in another user's storage namespace, leading to confidential data disclosure. The attack path is straightforward once the endpoint is reachable, and no privilege escalation is needed.