CVE-2026-65012 is a missing authentication vulnerability in InvokeAI before version 6.13.7. The GET /api/v2/models/scan_folder endpoint accepts attacker-controlled scan_path parameters without authentication, enabling unauthenticated attackers to recursively enumerate arbitrary directories on the server filesystem. This allows attackers to bypass multi-user mode access controls and infer file existence and readability based on HTTP response codes. No official remediation or patch has been confirmed as of the published date.

Unauthenticated attackers can perform directory enumeration on the server hosting InvokeAI, potentially exposing the presence and readability of sensitive files. This bypasses intended multi-user mode access controls, increasing the risk of information disclosure. There is no indication of remote code execution or data modification from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected endpoint and monitor for suspicious requests targeting the /api/v2/models/scan_folder endpoint. Avoid exposing the service to untrusted networks.