Dashboard / CVE-2026-5022

CVE-2026-5022

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 63/100
Published: 2026-03-27 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: X
AT: Present
VC: Low
VI: None
VA: None

Description

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
langflow langflow -

References & Advisories (1)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

6.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.21%
Raw Score 0.002120
Percentile 11.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00212
2026-10-28
0.00212

Intelligence Sources

nvd ref →

External Links