CVE-2026-12945 is an authorization bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.1. Authenticated users can exploit improper access controls on log retrieval and unauthenticated build endpoints to access and manipulate build jobs belonging to other users. This vulnerability is classified under CWE-639, indicating an authorization bypass through user-controlled keys. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

Exploitation of this vulnerability allows an authenticated user to access sensitive build job information of other users, potentially exposing confidential data. While the integrity of the build jobs is not impacted, the confidentiality breach is significant. Availability impact is low, meaning the service remains largely operational despite exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by IBM at this time. Users should monitor IBM's advisories for updates and consider restricting access to the affected endpoints until a fix is available.