Disclosed weakness · no CVE recorded

Langflow did not consistently apply flow permissions to event access

Langflow · Langflow

First documented disclosure · Review checkpoint

Summary

A user could read or change the events of a flow without its corresponding read or write permission.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Flow event operations did not apply the same read and write checks as the flow itself.

Conditions required

An account can access flow event functions without the corresponding permission for the selected flow.

Potential impact

Flow event data could be read or changed beyond granted access.

Affected versions and configurations

The affected behavior is documented. The full version range is not established.

Fix and mitigation status

1.13.2 lists this correction; other release lines may differ.

Practical next steps

Use a release containing this correction. Review flow shares and audit event writes.

Operating lesson

Enforce object permissions on event APIs as well as on the underlying object.

Evidence and limits

The project describes the correction in the linked public changes and lists it in 1.13.2. No CVE assignment or complete affected range was established.

Sources