Flowsint: Broken Access Control allows modification of investigation metadata from any user

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3.

Problem type

CWE-284: Improper Access Control

Affected products

reconurge

flowsint

< 1.2.3 - AFFECTED

References

https://github.com/reconurge/flowsint/security/advisories/GHSA-5h6v-5hv3-3jjw

https://github.com/reconurge/flowsint/security/advisories/GHSA-5h6v-5hv3-3jjw

x_refsource_CONFIRM

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-42158

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-42158",
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "dateUpdated": "2026-05-12T23:01:23.174Z",
    "dateReserved": "2026-04-24T17:15:21.835Z",
    "datePublished": "2026-05-12T23:01:23.174Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M",
        "dateUpdated": "2026-05-12T23:01:23.174Z"
      },
      "title": "Flowsint: Broken Access Control allows modification of investigation metadata from any user",
      "descriptions": [
        {
          "lang": "en",
          "value": "Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3."
        }
      ],
      "affected": [
        {
          "vendor": "reconurge",
          "product": "flowsint",
          "versions": [
            {
              "version": "< 1.2.3",
              "status": "affected"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-284: Improper Access Control",
              "cweId": "CWE-284",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://github.com/reconurge/flowsint/security/advisories/GHSA-5h6v-5hv3-3jjw",
          "name": "https://github.com/reconurge/flowsint/security/advisories/GHSA-5h6v-5hv3-3jjw",
          "tags": [
            "x_refsource_CONFIRM"
          ]
        }
      ],
      "metrics": [
        {}
      ]
    }
  }
}