CVE-2026-124036 · Vendor
NO FIX YET · SEE WHAT TO DO
FlockOS, Flock's hosted public safety platform, lacked authorization checks on its visual alert feature before 2026-09-28. An authenticated user in one organization could read, change, or delete another organization's saved-search alerts and their recipients, and create alerts under another organization.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affected organizations used the hosted FlockOS visual alert feature before 2026-09-28. Flock fixed the hosted service on that date, and the sources say no customer action is required. Self-hosting is not described in the sources.
Not affected if fixed-after-2026-09-28
Who cares flockos, public-safety, saas
Unknown from the sources.
Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts and change their recipients, given the alert's identifier, and to create alerts attributed to another organization. Flock remediated the issue in the hosted service on 2026-09-28; no customer action is required.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.