CVE-2026-124037 · Vendor
NO FIX YET · SEE WHAT TO DO
A public access-list sign-up feature in the Flock Safety Platform let an unauthenticated attacker with a community's sign-up link and a registered license plate look up that person's name, email, home address and approval status. Each lookup required solving a CAPTCHA, and no plate reader detections, images or video were exposed.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Communities that used the public access-list sign-up feature of the Flock Safety Platform between 2026-06-23 and 2026-10-22 had registrants exposed. The sources say the hosted service was fixed and no customer action is required, so the exposure is over for hosted customers. The sources do not say whether other deployments were affected.
Not affected if hosted-service-patched, outside-sign-up-window
Who cares flock-safety, hosted-saas, license-plate-reader
Unknown from the sources.
An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a registered vehicle's license plate to retrieve that registrant's name, email address, home address and approval status. Each lookup required solving a CAPTCHA. No license plate reader detections, images or video were exposed. Flock remediated the issue in the hosted service on 2026-10-22; no customer action is required.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.