Executive brief
Flowsint is an open-source tool used by cybersecurity professionals to visualize and investigate intelligence data. A security flaw allows any logged-in user to modify the names, descriptions, and status of investigations belonging to other users if they know the specific investigation ID. This could lead to the falsification of investigation records or the disruption of ongoing security research.
Technical details
An improper access control vulnerability (CWE-284) exists in the `update_investigation` endpoint within `flowsint-api/app/api/routes/investigations.py`. The application fails to verify if the `current_user` requesting the update has ownership or appropriate permissions for the specified `investigation_id`. An authenticated attacker who obtains a valid UUID for another user's investigation can issue a PUT request to modify its name, description, and status. While the attack requires knowledge of a non-enumerable investigation ID, successful exploitation compromises the integrity of investigation metadata. The issue is resolved in version 1.2.3.
Affected products
- reconurge Flowsint < 1.2.3
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fix released in version 1.2.3