Flowsint CVE-2026-44352
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible but requires low-privilege account (PR:L); only sketch log confidentiality is exposed (C:L); no integrity, availability, or scope-change impact applies.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access Control allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3.
AnalysisAI
Broken access control in Flowsint prior to 1.2.3 allows any authenticated user to read sketch logs belonging to arbitrary other users, constituting horizontal privilege escalation. The SSVC framework confirms a proof-of-concept exists and exploitation is automatable, though EPSS at 0.04% (12th percentile) reflects the niche deployment footprint of this OSINT tool. No active exploitation has been confirmed by CISA KEV; the risk is primarily insider threat or multi-tenant abuse where users share a single Flowsint instance.
Technical ContextAI
Flowsint is an open-source OSINT graph exploration tool (github.com/reconurge/flowsint) used for cybersecurity investigation and network visualization. The vulnerability is rooted in CWE-284 (Improper Access Control), specifically a failure to enforce authorization on the sketch logs retrieval endpoint - the server does not verify that the requesting user owns the requested log resource. This class of flaw, sometimes called insecure direct object reference (IDOR) or horizontal privilege escalation, arises when object identifiers (e.g., user IDs, log IDs) are user-supplied and the backend omits ownership validation. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L confirms network-accessible exploitation requiring only a low-privileged account with no additional attack preconditions.
Affected ProductsAI
Flowsint versions prior to 1.2.3 are affected. The vulnerability is present in all prior releases of the open-source OSINT graph exploration tool maintained at github.com/reconurge/flowsint. The fix is confirmed in version 1.2.3. No CPE string was provided in the source data; the authoritative vendor advisory is available at https://github.com/reconurge/flowsint/security/advisories/GHSA-9r98-g8q5-cpq5.
RemediationAI
Upgrade to Flowsint 1.2.3, which contains the vendor-confirmed fix for this broken access control issue. The security advisory is published at https://github.com/reconurge/flowsint/security/advisories/GHSA-9r98-g8q5-cpq5. For deployments that cannot immediately upgrade, restrict Flowsint instance access to a single trusted user or enforce network-level controls (e.g., firewall rules, VPN-only access) so that untrusted authenticated users cannot reach the sketch logs endpoint - this eliminates the horizontal escalation risk without requiring a code change, though it does not fix the underlying flaw and should be treated as a temporary compensating control only.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today