Missing Authenticity Verification in LangBot Affects Event Injection

CVE-2026-112265

What is CVE-2026-112265?

LangBot versions up to 4.11.0 are susceptible to a vulnerability that allows attackers to inject unauthorized Lark and Feishu events due to a lack of authenticity verification. This weakness enables unauthenticated individuals to exploit the system by crafting fake POST requests to the bot, impersonating legitimate user actions. By bypassing signature checks, attackers can route fabricated events, potentially manipulating workflows and gaining unauthorized access to system functionalities.

References