CVE-2026-55255 describes an authorization bypass vulnerability in langflow prior to version 1.9.2. The vulnerability exists due to insufficient access control on the /api/v1/responses endpoint, allowing an authenticated attacker to specify arbitrary flow IDs and execute flows owned by other users. This is a classic Insecure Direct Object Reference (IDOR) issue categorized under CWE-639. The vulnerability has a critical severity with a CVSS 3.1 base score of 9.9, indicating network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability is fixed in langflow version 1.9.2.

An authenticated attacker can execute any flow belonging to another user by specifying the victim's flow ID. This leads to complete compromise of confidentiality and integrity of the victim's flows, and partial impact on availability. The attacker can abuse workflows they do not own, potentially causing unauthorized actions or data exposure.

Upgrade langflow to version 1.9.2 or later, where this vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed fixed in 1.9.2.