CVE-2026-42158 Flowsint: Broken Access Control allows modification of investigation metadata from any user
An attacker can modify investigation metadata of other users by knowing the investigation ID, affecting Flowsint users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42158?
CVE-2026-42158 is a low-severity missing authorization vulnerability in reconurge flowsint, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3.
Weakness: CWE-284
Which versions are affected by CVE-2026-42158?
How do I fix CVE-2026-42158?
No fix has been published for CVE-2026-42158 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-42158 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42158 exists.
Sources
Also known as GHSA-5h6v-5hv3-3jjw.