{"id":"CVE-2024-7297","aliases":["EUVD-2024-48240","GHSA-6j6g-j4qm-m9jf"],"status":"published","title":"Langflow Privilege Escalation","description":"Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.21183,"percentile":0.97605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-913"],"published":"2024-07-30T16:13:48Z","modified":"2026-10-28T02:30:29Z","products":[{"vendor":"langflow","product":"langflow"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2024-26","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7297","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6j6g-j4qm-m9jf"},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7297.json","tags":["advisory"]},{"url":"https://github.com/langflow-ai/langflow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-7297","title":"Langflow Privilege Escalation","description":"Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.","status":"published","published":"2024-07-30T16:13:48.008Z","modified":"2026-03-27T15:51:29.431Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-48240","description":"Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.","status":"published","published":"2024-07-30T16:13:48Z","modified":"2026-03-27T15:51:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:27.277964Z"}],"ghsa":[{"id":"GHSA-6j6g-j4qm-m9jf","title":"Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a...","description":"Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.","status":"published","published":"2024-07-30T18:32:06Z","modified":"2024-07-30T18:32:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:57:45.165794Z"}],"nvd":[{"id":"CVE-2024-7297","description":"Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.","status":"published","published":"2024-07-30T17:15:14.513Z","modified":"2026-06-17T08:19:48.01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:10:15.933769Z"}],"osv":[{"id":"CVE-2024-7297","title":"Langflow Privilege Escalation","description":"Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.","status":"published","published":"2024-07-30T16:13:48.008Z","modified":"2026-10-28T02:30:29.739722381Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:44:45.405014Z"}]}}