---
id: "CVE-2026-124036"
page: "https://infrastack.ai/live/CVE-2026-124036"
kind: "vulnerability"
aliases: ["CVE-2026-124036"]
title: "FlockOS: missing checks let one organization edit another's alerts"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["flockos", "public-safety", "saas", "vendor"]
not_affected_if: ["fixed-after-2026-09-28"]
published_at: "2026-11-10T16:17:18+00:00"
first_seen_at: "2026-11-10T16:22:34+00:00"
updated_at: "2026-11-10T16:23:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124036", "first_seen_at": "2026-11-10T16:22:34+00:00"}]
exploit_sources: []
---

# FlockOS: missing checks let one organization edit another's alerts

Link for people: https://infrastack.ai/live/CVE-2026-124036 (this .md is for agents)

FlockOS, Flock's hosted public safety platform, lacked authorization checks on its visual alert feature before 2026-09-28. An authenticated user in one organization could read, change, or delete another organization's saved-search alerts and their recipients, and create alerts under another organization.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Flock remediated the issue in the hosted service on 2026-09-28; no customer action is required according to the sources.

## Timeline

- 2026-11-10T16:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124036

## From the sources

Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts and change their recipients, given the alert's identifier, and to create alerts attributed to another organization. Flock remediated the issue in the hosted service on 2026-09-28; no customer action is required.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_