CVE-2026-112265highCWE-345

CVE-2026-112265: high-severity vulnerability in langbot-app LangBot

LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification

Published

Follow this CVE+ Monitor LangBot

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 0.2%
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
langbot-app · LangBot
Related CVEs — langbot-app LangBot

In the same product, most dangerous first.

CVE-2026-90562CRITICALLangBot before 4.10.11 Authentication Bypass via Weak Recovery KeyEPSS 0.7%CVE-2026-54449HIGHLangBot: Authenticated RCE Via MCP ConfigurationEPSS 0.7%CVE-2026-90938HIGHLangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketEPSS 0.6%CVE-2025-59835HIGHLangBot has a cross-directory file upload vulnerability, which could lead to system takeoverEPSS 0.4%CVE-2026-28509MEDIUMLangBot has a Cross Site Scripting(XSS) VulnerabilityEPSS 0.2%