# CVE-2026-44352: reconurge Flowsint broken access control in sketch logs

Source: https://junglewise.ai/threats/cve-2026-44352-reconurge-flowsint-broken-access-control-in-sketch-logs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44352 · Severity: info · CVSS 5.3 · Published 2026-05-12

Flowsint is an open-source tool used by cybersecurity professionals to map and investigate digital footprints during investigations. A security flaw allows any registered user to view the activity logs and investigation data of other users. This could lead to the exposure of sensitive research targets, usernames, and websites being tracked by other investigators, potentially compromising confidential operations.

Technologies: [Reconurge Flowsint](https://junglewise.ai/threats/technologies/flowsint). Vendors: [Reconurge](https://junglewise.ai/threats/vendors/reconurge).

## Quick answers

**Is CVE-2026-44352 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44352 being exploited in the wild.

**How severe is CVE-2026-44352?** Informational severity, with a CVSS score of 5.3, published 12 May 2026.

**Which products and versions are affected?** Reconurge Flowsint < 1.2.3.

**Is there a fix for CVE-2026-44352?** A patch was published on 2026-05-12: Vulnerability fixed in version 1.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44352 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44352?** Check whether you run Reconurge Flowsint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in Flowsint's API due to improper authorization checks in the scan and event routes. Specifically, the `/api/scans` endpoint leaks `sketch_id` values for all scans in the database because it lacks ownership filtering. Furthermore, the `/api/events/sketch/{sketch_id}/logs` endpoint has the `current_user` dependency commented out in the source code, allowing any authenticated user to query logs for any valid `sketch_id`. An attacker can exploit this to monitor 'transformers' (automated processes) run by other users and extract graph data, such as node labels and relationships, via 'GRAPH_APPEND' payloads in the logs. This issue is resolved in version 1.2.3.

## Affected products

- reconurge Flowsint < 1.2.3

## Timeline

- 2026-05-06: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Vulnerability fixed in version 1.2.3

## References

- [https://github.com/reconurge/flowsint/security/advisories/GHSA-9r98-g8q5-cpq5](https://github.com/reconurge/flowsint/security/advisories/GHSA-9r98-g8q5-cpq5)

## Related threats

- [Reconurge Flowsint stored XSS in node description](https://junglewise.ai/threats/cve-2026-42159-reconurge-flowsint-stored-xss-in-node-description)
- [reconurge Flowsint improper access control in investigation metadata update](https://junglewise.ai/threats/cve-2026-42158-reconurge-flowsint-improper-access-control-in-investigation)
- [Reconurge Flowsint stored XSS in map node markers](https://junglewise.ai/threats/cve-2026-42157-reconurge-flowsint-stored-xss-in-map-node-markers)
- [reconurge Flowsint Cypher injection in node creation](https://junglewise.ai/threats/cve-2026-42156-reconurge-flowsint-cypher-injection-in-node-creation)
- [Reconurge Flowsint command injection and container escape in org_to_asn](https://junglewise.ai/threats/cve-2026-32311-reconurge-flowsint-command-injection-and-container-escape-in-org)