CVE-2026-12945 is an authorization bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.1. Authenticated users can exploit improper access control mechanisms on log retrieval and unauthenticated build endpoints to access and manipulate build jobs belonging to other users. This vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges of low, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

An attacker with authenticated access can bypass authorization controls to view and manipulate build jobs of other users. This leads to a high confidentiality impact as sensitive build job data may be exposed. Integrity is not impacted, but availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor IBM's advisories for updates. Until a fix is available, restrict authenticated user privileges to trusted users only and consider additional access controls to limit exposure.