CVE-2026-55255 describes an authorization bypass vulnerability in langflow prior to version 1.9.1. The issue is an Insecure Direct Object Reference (IDOR) in the /api/v1/responses endpoint, where an authenticated attacker with low privileges can specify another user's flow ID to execute that flow. This allows unauthorized access and execution of workflows belonging to other users. The vulnerability has a CVSS 3.1 base score of 8.4, reflecting network attack vector, high impact on confidentiality and integrity, and low privileges required. The vulnerability is fixed in langflow version 1.9.1.

An attacker with valid authentication can execute any flow owned by another user by manipulating the flow ID parameter. This leads to unauthorized access and control over other users' workflows, potentially exposing sensitive data and allowing malicious actions within the affected system. The impact includes high confidentiality and integrity loss, with limited availability impact.

Upgrade langflow to version 1.9.1 or later, where this authorization bypass vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 1.9.1.