What is GHSA-qf42-fp6f-25w9?

GHSA-qf42-fp6f-25w9 is a security advisory published by GitHub Security Advisories with High severity. IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership...

Which CVE IDs does GHSA-qf42-fp6f-25w9 cover?

GHSA-qf42-fp6f-25w9 covers the following CVE IDs: CVE-2026-107366. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qf42-fp6f-25w9?

GHSA-qf42-fp6f-25w9 has a CVSS v3 base score of 8.3, published by GitHub Security Advisories.

GHSA-qf42-fp6f-25w9HighCVSS 8.3

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership...

Vendor

GitHub Security Advisories

Published

October 20, 2026

Last Modified

October 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-107366 →

📋 Description

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-107366
https://www.ibm.com/support/pages/node/7293016
https://github.com/advisories/GHSA-qf42-fp6f-25w9