CVE-2026-7787

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
IBM	Langflow OSS	>= 1.0.0, <= 1.9.1

References

https://www.ibm.com/support/pages/node/7275453Vendor Advisory

Timeline

Published: Jun 11, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-778716.4The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcod CVE-2026-778737.3An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with CVE-2026-778748.6IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenti CVE-2026-778756.8The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundar CVE-2026-778768.8Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel mo CVE-2026-778777.8Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the CVE-2026-778787.8Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore rou CVE-2026-778797.1Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_t CVE-2026-77887.3A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is th CVE-2026-778807.8Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change rout CVE-2026-778815.5Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route t CVE-2026-778827.8A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to exec