Executive brief
Flowsint is an open-source tool used by cybersecurity professionals to map and investigate digital footprints during investigations. A security flaw allows any registered user to view the activity logs and investigation data of other users. This could lead to the exposure of sensitive research targets, usernames, and websites being tracked by other investigators, potentially compromising confidential operations.
Technical details
A broken access control vulnerability exists in Flowsint's API due to improper authorization checks in the scan and event routes. Specifically, the `/api/scans` endpoint leaks `sketch_id` values for all scans in the database because it lacks ownership filtering. Furthermore, the `/api/events/sketch/{sketch_id}/logs` endpoint has the `current_user` dependency commented out in the source code, allowing any authenticated user to query logs for any valid `sketch_id`. An attacker can exploit this to monitor 'transformers' (automated processes) run by other users and extract graph data, such as node labels and relationships, via 'GRAPH_APPEND' payloads in the logs. This issue is resolved in version 1.2.3.
Affected products
- reconurge Flowsint < 1.2.3
Timeline
- 2026-05-06: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Vulnerability fixed in version 1.2.3