CVE-2026-42158: reconurge Flowsint improper access control in investigation metadata update

CVE-2026-42158 · Severity: info · CVSS 2.3 · Published 2026-05-12

Flowsint is an open-source tool used by cybersecurity professionals to visualize and investigate intelligence data. A security flaw allows any logged-in user to modify the names, descriptions, and status of investigations belonging to other users if they know the specific investigation ID. This could lead to the falsification of investigation records or the disruption of ongoing security research.

Technologies: Reconurge Flowsint. Vendors: Reconurge.

Quick answers

Is CVE-2026-42158 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42158 being exploited in the wild.
How severe is CVE-2026-42158?
Informational severity, with a CVSS score of 2.3, published 12 May 2026.
Which products and versions are affected?
Reconurge Flowsint < 1.2.3.
Is there a fix for CVE-2026-42158?
A patch was published on 2026-05-12: Fix released in version 1.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42158 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42158?
Check whether you run Reconurge Flowsint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284) exists in the `update_investigation` endpoint within `flowsint-api/app/api/routes/investigations.py`. The application fails to verify if the `current_user` requesting the update has ownership or appropriate permissions for the specified `investigation_id`. An authenticated attacker who obtains a valid UUID for another user's investigation can issue a PUT request to modify its name, description, and status. While the attack requires knowledge of a non-enumerable investigation ID, successful exploitation compromises the integrity of investigation metadata. The issue is resolved in version 1.2.3.

Affected products

  • reconurge Flowsint < 1.2.3

Timeline

  • 2026-04-29: advisory: GitHub Security Advisory published
  • 2026-05-12: disclosed: CVE published to NVD
  • 2026-05-12: patched: Fix released in version 1.2.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.