CVE-2026-9225: IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging

IBM Langflow OSS versions 1.0.0 through 1.11.5 has a vulnerability where an authenticated attacker (someone with login access) can read files belonging to other users by exploiting improper access control in the File/Read File component. When a user runs workflows through a specific API endpoint, the application doesn't properly verify that the file path belongs to them, allowing attackers to craft requests that access and retrieve files from other users' storage areas.