CVE-2026-112265 — LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature…
Published: 2026-10-19 · CVSS: 8.3 · CVSS 4.0
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7