CVE-2024-7297
High · 8.8CVSS
8.8
EPSS
21.2%
Published
Jul 30, 2024
CISA due date
—
The record
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121170 Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a… CWE-913
- CVE-2026-62848 Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. CWE-913
- CVE-2026-118538 A vulnerability was determined in a2ui-project a2ui up to 0.12.0. CWE-913
- CVE-2026-116612 A flaw was found in GStreamer Editing Services (gst-editing-services). CWE-913
- CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer… CWE-913
- CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers… CWE-913
- CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is… CWE-913
- CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. CWE-913