Flowsint versions before 1.2.3 contain an improper access control vulnerability (CWE-284) that allows an adversary who knows an investigation ID to modify metadata of investigations owned by other users. This could lead to unauthorized modification of investigation data. The vulnerability is fixed in flowsint 1.2.3. The CVSS 4.0 base score is 2.3, reflecting low severity due to high attack complexity and limited impact. No official remediation level or patch link is provided, but upgrading to 1.2.3 is the known fix.

An attacker with limited privileges and knowledge of an investigation ID could update metadata of investigations they do not own, potentially affecting data integrity. The impact is limited to metadata modification without reported privilege escalation or data disclosure. The low CVSS score reflects the low severity and complexity of exploitation.

Upgrade flowsint to version 1.2.3 or later, where this improper access control vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version and apply the update from the official source. No other mitigation is indicated.