Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints

Vulnerability

Langflow's /api/v1/monitor router (file src/backend/base/langflow/api/v1/monitor.py) exposes seven endpoints that perform read, write, and delete operations on user-owned resources—messages, sessions, build artifacts, and LLM transaction logs—without verifying that the authenticated requester owns the targeted resource. The correct ownership check (joining MessageTable with Flow and filtering by Flow.user_id == current_user.id) is implemented only in the GET /monitor/messages endpoint, demonstrating the pattern was known but inconsistently applied. All versions prior to the fix are affected [1][2].

Exploitation

An attacker needs only a valid authenticated session to Langflow. By supplying the target's resource ID (e.g., flow_id, message_id) to any of the vulnerable endpoints, the attacker can read, modify, rename, or permanently delete another user's data. No special privileges or user interaction beyond authentication is required. For example, sending a DELETE request to /api/v1/monitor/messages with a list of arbitrary message_ids will delete those messages without ownership verification [1][2].

Impact

Successful exploitation allows an authenticated attacker to access, alter, or destroy another user's private data, including messages, session information, build artifacts, and LLM transaction logs. This constitutes a breach of confidentiality, integrity, and availability (CIA) for the targeted user's resources. The attacker gains the same level of access as the legitimate owner, effectively bypassing authorization controls [1][2].

Mitigation

The advisory (GHSA-9c59-2mvc-vfr8) recommends applying the ownership check pattern used in the GET /monitor/messages endpoint to all seven vulnerable endpoints. As of the publication date (2026-06-16), a fixed version has not been explicitly mentioned in the available references; users should monitor the Langflow repository for a patch. No workaround is provided. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the advisory date [1][2].