CVE-2026-124036
Received Received - Intake

Authorization Bypass in FlockOS Visual Alert Feature

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: flock

Description
Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts and change their recipients, given the alert's identifier, and to create alerts attributed to another organization. Flock remediated the issue in the hosted service on 2026-09-28; no customer action is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-124036
EUVD
EUVD-2026-121264

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flock flockos to 2026-09-28 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves missing authorization checks in FlockOS's visual alert feature. An authenticated user with saved search management permissions could read, modify, or delete alerts belonging to another organization, change alert recipients, or create alerts under another organization's name using just the alert's identifier.

Impact Analysis

If exploited, this flaw could allow unauthorized access to sensitive alert data across organizations, enabling attackers to manipulate emergency alerts, redirect notifications, or impersonate other organizations. This could lead to misinformation, operational disruptions, or reputational damage.

Compliance Impact

This vulnerability likely violates data protection and privacy regulations by enabling unauthorized access to sensitive alert data. GDPR may require breach notification, while HIPAA could be impacted if alerts contain protected health information. Compliance risks include fines and legal liabilities.

Mitigation Strategies

Ensure FlockOS is updated to the version released on or after 2026-09-28. No further action is required as the issue was remediated in the hosted service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...