Langflow Missing Authorization Vulnerability in Image Download Endpoint

A vulnerability exists in the Langflow application within the image download API endpoint. This endpoint lacks proper authentication and authorization checks, enabling any unauthenticated user to download images from any flow by simply knowing or guessing the flow ID and file name. The issue is present in the '/api/v1/files/images/{flow_id}/{file_name}' endpoint.

Impact

Exploitation of this vulnerability allows for unauthorized access to images, potentially leading to the exposure of sensitive information contained within those images.