CVE-2026-42158: low-severity vulnerability in reconurge flowsint
Flowsint: Broken Access Control allows modification of investigation metadata from any user
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.3epss 0.2%
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
reconurge · flowsintRelated CVEs — reconurge flowsint
In the same product, most dangerous first.
CVE-2026-32311CRITICALCommand Injection and Docker container escape allows root on host machineEPSS 0.5%CVE-2026-42156HIGHFlowsint: Cypher query injection in node type on node creationEPSS 0.3%CVE-2026-42157MEDIUMFlowsint: Stored XSS on map node marker in map pageEPSS 0.3%CVE-2026-44352MEDIUMFlowsint: Broken Access Control allows reading of sketch logs from any userEPSS 0.3%CVE-2026-42159MEDIUMFlowsint: Stored XSS in description of nodeEPSS 0.2%