Flowsint versions before 1.2.3 suffer from a broken access control vulnerability that permits unauthorized reading of sketch logs by any user. This flaw violates proper access control mechanisms, potentially exposing sensitive investigation data. The vulnerability is identified as CWE-284 and has a CVSS 4.0 base score of 5.3, indicating a medium severity level. The issue is resolved in version 1.2.3 of Flowsint.

The vulnerability allows users with limited privileges to read sketch logs that should be access-restricted. This could lead to unauthorized disclosure of potentially sensitive information contained in these logs. There is no indication of privilege escalation, code execution, or other impacts. No known exploits are reported in the wild.

Upgrade Flowsint to version 1.2.3 or later, where this access control vulnerability has been fixed. Since the vendor advisory or patch links are not explicitly provided, users should verify the update from the official Flowsint repository or vendor channels. Patch status is not explicitly confirmed beyond the statement that the issue is fixed in 1.2.3, so checking the vendor advisory for the latest remediation guidance is recommended.