Super admin escalation via mass-assigned user role

Privilege escalation in Langflow before 1.0.13 allows remote authenticated users to gain super admin access through the users API. The vulnerable PATCH /api/v1/users/{user_id} handler accepts an is_superuser field in the UserUpdate body and writes it without blocking low-privileged accounts. A valid low-privileged account and its bearer token are required; successful exploitation converts that account into a superuser with application-wide administrative access.