CVE-2026-19875 affects IBM Langflow OSS versions 1.0.0 through 1.10.0 by lacking authentication on a critical registration endpoint. This allows remote attackers to overwrite administrator email settings and abuse the server for outbound relay purposes. The vulnerability is identified as CWE-306, indicating missing authentication controls on a critical function. The CVSS v3.1 base score is 7.5, reflecting high impact on integrity with no confidentiality or availability impact. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker can remotely overwrite administrator email information, potentially enabling abuse of the server as an outbound relay. This compromises the integrity of administrative settings and could facilitate further malicious activities such as spam relay or phishing campaigns. There is no reported impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the registration endpoint and monitor for unauthorized changes to administrator email settings.