{"id":"CVE-2026-5022","summary":"Langflow - Missing Authorization on download_image Endpoint","details":"The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.","modified":"2026-10-08T02:51:03.331117495Z","published":"2026-03-27T14:34:14.046Z","database_specific":{"cna_assigner":"tenable","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5022.json"},"references":[{"type":"WEB","url":"https://www.tenable.com/security/research/tra-2026-23"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5022.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5022"},{"type":"PACKAGE","url":"https://github.com/langflow-ai/langflow"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/langflow-ai/langflow","events":[{"introduced":"0"},{"last_affected":"0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0"}],"source":"AFFECTED_FIELD"}}],"versions":["0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5022.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}