Flowsint CVE-2026-42158
LOWSeverity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint but requires authentication (PR:L) and prior knowledge of a victim's investigation ID (AC:H); impact is limited to integrity of investigation metadata with no confidentiality or availability consequences.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3.
AnalysisAI
Improper access control in Flowsint prior to version 1.2.3 permits authenticated users to modify the investigation metadata of any other user by supplying a known or guessed investigation ID, bypassing all ownership checks. The affected product is an open-source OSINT graph exploration platform used in cybersecurity investigation workflows. SSVC classifies exploitation status as poc with partial technical impact; EPSS of 0.04% (12th percentile) and a CVSS 4.0 score of 2.3 indicate very low real-world exploitation probability, though multi-user deployments conducting sensitive investigations face a meaningful data-integrity risk.
Technical ContextAI
Flowsint is an open-source OSINT (Open Source Intelligence) graph exploration tool built for cybersecurity investigation, transparency, and verification use cases, hosted at github.com/reconurge/flowsint. The root cause is CWE-284 (Improper Access Control), specifically a broken object-level authorization (BOLA/IDOR) pattern in the investigation metadata update functionality. The application fails to validate that the requesting authenticated user is the owner or an authorized collaborator of the target investigation before processing the update. Investigation IDs appear to serve as the de facto access token - possessing the ID grants write access to the associated investigation metadata, regardless of user identity. No CPE string was provided in the advisory data.
Affected ProductsAI
Flowsint versions prior to 1.2.3 are affected. This covers all prior releases of the open-source OSINT graph exploration tool maintained at https://github.com/reconurge/flowsint. The fix is included in Flowsint 1.2.3, as confirmed by GitHub Security Advisory GHSA-5h6v-5hv3-3jjw published at https://github.com/reconurge/flowsint/security/advisories/GHSA-5h6v-5hv3-3jjw. No CPE string was provided in the available advisory data; version ranges are sourced from the vendor advisory only.
RemediationAI
Upgrade Flowsint to version 1.2.3 or later, which contains the vendor-released patch for this improper access control flaw, as documented in the GitHub Security Advisory GHSA-5h6v-5hv3-3jjw at https://github.com/reconurge/flowsint/security/advisories/GHSA-5h6v-5hv3-3jjw. If immediate upgrade is not feasible, restrict network access to the Flowsint instance to trusted users only, reducing the pool of authenticated accounts that could abuse the flaw - note this does not eliminate the vulnerability but limits attacker opportunity. Additionally, audit investigation ID generation to ensure IDs are sufficiently random and non-sequential, which increases AC:H complexity and makes ID enumeration or guessing harder in practice. Review access logs for unexpected cross-user investigation update events as a detective control.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today