CVE-2026-44352: Broken Access Control in Flowsint
Platform
javascript
Component
flowsint
Fixed in
1.2.3
CVE-2026-44352 describes a broken access control vulnerability in Flowsint, an open-source OSINT graph exploration tool. This flaw allows unauthorized users to read sketch logs, potentially compromising investigation data and verification processes. The vulnerability affects versions 1.0.0 through 1.2.2 and has been resolved in version 1.2.3.
Impact and Attack Scenarios
The primary impact of this broken access control is the exposure of sketch logs. These logs contain valuable information gathered during OSINT investigations, including data sources, analysis steps, and potentially sensitive details about targets. An attacker could leverage this information to understand investigation methodologies, identify potential biases, or even manipulate future investigations. While the vulnerability doesn't grant direct system access, the compromise of investigation data can significantly undermine the integrity and reliability of cybersecurity efforts. The blast radius extends to any organization or individual relying on Flowsint for OSINT analysis.
Exploitation Context
As of the publication date (2026-05-12), there is no public proof-of-concept (POC) code available for CVE-2026-44352. The vulnerability's severity is pending evaluation. It is not currently listed on KEV or EPSS. Active exploitation campaigns are not known at this time, but the ease of exploitation (requiring only basic authentication bypass) suggests a potential for future targeting.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
Mitigation and Workarounds
The definitive mitigation for CVE-2026-44352 is to upgrade Flowsint to version 1.2.3 or later. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider restricting access to the Flowsint instance to authorized personnel only. Implement strict user authentication and authorization policies to limit the potential for unauthorized log access. There are no specific WAF rules or configuration workarounds available beyond these access control measures. After upgrading, verify the fix by attempting to access sketch logs with a non-authorized user account; access should be denied.
How to fix
Actualice Flowsint a la versión 1.2.3 o superior para mitigar la vulnerabilidad de control de acceso roto. Esta actualización corrige el problema que permitía a cualquier usuario leer los registros de bocetos.
Frequently asked questions
What is CVE-2026-44352 — Broken Access Control in Flowsint?
CVE-2026-44352 is a broken access control vulnerability in Flowsint versions 1.0.0 through 1.2.2, allowing unauthorized reading of sketch logs. This impacts the integrity of OSINT investigations.
Am I affected by CVE-2026-44352 in Flowsint?
You are affected if you are using Flowsint version 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0, 1.2.1, or 1.2.2. Upgrade to 1.2.3 to resolve the issue.
How do I fix CVE-2026-44352 in Flowsint?
Upgrade Flowsint to version 1.2.3 or later. If immediate upgrade is not possible, restrict access to the Flowsint instance and implement strong authentication.
Is CVE-2026-44352 being actively exploited?
As of the publication date, there are no known active exploitation campaigns targeting CVE-2026-44352, but potential exists due to the ease of exploitation.
Where can I find the official Flowsint advisory for CVE-2026-44352?
Refer to the official Flowsint project repository and release notes for the advisory regarding CVE-2026-44352: [https://github.com/Flowsint/Flowsint](https://github.com/Flowsint/Flowsint)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...