CVE-2026-42158: CWE-284: Improper Access Control in reconurge flowsint
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3.
AI Analysis
Technical Summary
CVE-2026-42158 describes an improper access control vulnerability in Flowsint versions before 1.2.3. The flaw allows an adversary who knows a valid investigation ID to modify metadata of investigations owned by other users, violating access control policies. This could lead to unauthorized modification of investigation data. The vulnerability is addressed in Flowsint version 1.2.3.
Potential Impact
The vulnerability allows unauthorized users with limited privileges and knowledge of an investigation ID to update metadata of investigations they do not own. The impact is limited to metadata modification and does not include privilege escalation or data disclosure. The CVSS 4.0 base score is 2.3, indicating low severity.
Mitigation Recommendations
Upgrade Flowsint to version 1.2.3 or later, where this improper access control vulnerability has been fixed. No other mitigation steps are indicated or necessary.
CVE-2026-42158: CWE-284: Improper Access Control in reconurge flowsint
Description
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3.
CVSS v4.0
Score 2.3low
Affected software
pkg:github/reconurge/flowsintRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-42158 describes an improper access control vulnerability in Flowsint versions before 1.2.3. The flaw allows an adversary who knows a valid investigation ID to modify metadata of investigations owned by other users, violating access control policies. This could lead to unauthorized modification of investigation data. The vulnerability is addressed in Flowsint version 1.2.3.
Potential Impact
The vulnerability allows unauthorized users with limited privileges and knowledge of an investigation ID to update metadata of investigations they do not own. The impact is limited to metadata modification and does not include privilege escalation or data disclosure. The CVSS 4.0 base score is 2.3, indicating low severity.
Mitigation Recommendations
Upgrade Flowsint to version 1.2.3 or later, where this improper access control vulnerability has been fixed. No other mitigation steps are indicated or necessary.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-24T17:15:21.835Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a03d8cbcbff5d86103ec19b
Added to database: 05/13/2026, 01:50:03 UTC
Last enriched: 05/20/2026, 18:49:52 UTC
Last updated: 07/05/2026, 20:51:23 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.