PT-2026-26095 · Pypi · Langflow

Published

2026-03-18

·

Updated

2026-03-18

·

CVE-2026-33053

CVSS v4.0

7.1

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Detection Method: Kolega.dev Deep Code Scan
AttributeValue
Locationsrc/backend/base/langflow/api/v1/api key.py:44-53
Practical ExploitabilityHigh
Developer Approverfaizan@kolega.ai

Description

The delete api key route() endpoint accepts an api key id path parameter and deletes it with only a generic authentication check (get current active user dependency). However, the delete api key() CRUD function does NOT verify that the API key belongs to the current user before deletion.

Affected Code

@router.delete("/{api key id}", dependencies=[Depends(auth utils.get current active user)])
async def delete api key route(
  api key id: UUID,
  db: DbSession,
):
  try:
    await delete api key(db, api key id)
  except Exception as e:
    raise HTTPException(status code=400, detail=str(e)) from e
  return {"detail": "API Key deleted"}

Evidence

In crud.py lines 44-49, delete api key() retrieves the API key by ID and deletes it without checking if the key belongs to the authenticated user. The endpoint also doesn't pass the current user to the delete function for verification.

Impact

An authenticated attacker can enumerate and delete API keys belonging to other users by guessing or discovering their API key IDs. This allows account takeover, denial of service, and disruption of other users' integrations.

Recommendation

Modify the delete api key endpoint and function: (1) Pass current user to the delete function; (2) In delete api key(), verify api key.user id == current user.id before deletion; (3) Raise a 403 Forbidden error if the user doesn't own the key. Example: if api key.user id != user id: raise HTTPException(status code=403, detail='Unauthorized')

Notes

Confirmed IDOR vulnerability. The delete api key route endpoint at line 44-53 accepts an api key id and calls delete api key(db, api key id) without passing the current user. The CRUD function delete api key() at crud.py:44-49 retrieves the API key by ID and deletes it without verifying ownership (api key.user id == current user.id). Compare this to the GET endpoint at lines 17-28 which correctly filters by user id, and the POST endpoint at lines 31-41 which correctly associates the key with user id. An authenticated attacker can delete any user's API keys by guessing/enumerating UUIDs. Fix: Pass current user to delete api key and verify api key.user id == current user.id before deletion, returning 403 if unauthorized.

Developer Review Notes

Does not accept current user as a parameter. Allowing deletion of any user's API keys even without permissions.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33053
GHSA-RF6X-R45M-XV3W

Affected Products

Langflow