{"id":"CVE-2026-124037","kind":"vulnerability","aliases":["CVE-2026-124037"],"related":[],"title":"Flock Safety Platform: public sign-up page leaked registrants' names and home addresses","description":"An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a registered vehicle's license plate to retrieve that registrant's name, email address, home address and approval status. Each lookup required solving a CAPTCHA. No license plate reader detections, images or video were exposed. Flock remediated the issue in the hosted service on 2026-10-22; no customer action is required.","summary":"A public access-list sign-up feature in the Flock Safety Platform let an unauthenticated attacker with a community's sign-up link and a registered license plate look up that person's name, email, home address and approval status. Each lookup required solving a CAPTCHA, and no plate reader detections, images or video were exposed.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flock-safety","hosted-saas","license-plate-reader","vendor"],"not_affected_if":["hosted-service-patched","outside-sign-up-window"],"how_to_check":null,"fix":"- Flock remediated the issue in the hosted service on 2026-10-22; the sources say no customer action is required.","status":"open","published_at":"2026-11-10T16:17:18+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:23+00:00","updated_at":"2026-11-10T16:23:23+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-10T16:23:23Z","model":"claude-haiku-5-5","output":{"fix":"- Flock remediated the issue in the hosted service on 2026-10-22; the sources say no customer action is required.","reach":"internet","title":"Flock Safety Platform: public sign-up page leaked registrants' names and home addresses","impact":"medium","summary":"A public access-list sign-up feature in the Flock Safety Platform let an unauthenticated attacker with a community's sign-up link and a registered license plate look up that person's name, email, home address and approval status. Each lookup required solving a CAPTCHA, and no plate reader detections, images or video were exposed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["flock-safety","license-plate-reader","hosted-saas"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads registrants' names, emails and home addresses for known plates","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["outside-sign-up-window","hosted-service-patched"],"who_is_affected":"Communities that used the public access-list sign-up feature of the Flock Safety Platform between 2026-06-23 and 2026-10-22 had registrants exposed. The sources say the hosted service was fixed and no customer action is required, so the exposure is over for hosted customers. The sources do not say whether other deployments were affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4627,"output_tokens":516,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-06':113C '-10':117C,180C '-124037':17A,20A '-2026':16A,19A '-22':118C,181C '-23':114C '2026':112C,116C,179C 'access':35B,99C 'access-list':34B,98C 'action':184C 'address':14A,71B,148C,150C 'allow':119C 'approv':73B,152C 'attack':49B,123C 'captcha':80B,159C 'communiti':52B,127C 'custom':183C 'cve':15A,18A 'detect':85B,164C 'email':69B,147C 'expos':90B,169C 'exposur':93C 'featur':40B,104C 'flaw':94C 'flock':1A,22B,43B,107C,170C 'flock-safeti':21B 'home':13A,70B,149C 'host':25B,176C 'hosted-saa':24B 'imag':86B,165C 'inform':92C 'issu':173C 'leak':9A 'let':46B 'licens':28B,61B,139C,161C 'license-plate-read':27B 'link':57B,133C 'list':36B,100C 'look':63B 'lookup':76B,155C 'name':11A,68B,146C 'page':8A 'person':66B 'plate':29B,62B,83B,140C,162C 'platform':3A,45B,109C 'present':110C 'public':4A,33B,97C,129C 'reader':30B,84B,163C 'regist':60B,136C 'registr':10A,144C 'remedi':171C 'remot':121C 'requir':77B,156C,186C 'retriev':142C 'saa':26B 'safeti':2A,23B,44B,108C 'servic':177C 'sign':6A,38B,55B,102C,131C 'sign-up':5A,37B,54B,101C,130C 'solv':78B,157C 'status':74B,153C 'unauthent':48B,122C 'vehicl':137C 'vendor':31B 'video':88B,167C","nicknames":[],"mitigations":[],"who_affected":"Communities that used the public access-list sign-up feature of the Flock Safety Platform between 2026-06-23 and 2026-10-22 had registrants exposed. The sources say the hosted service was fixed and no customer action is required, so the exposure is over for hosted customers. The sources do not say whether other deployments were affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["flocksafety","high","hostedsaas","licenseplatereader","vendor"],"campaign_type":null,"search_a":"'-124037':17A,20A '-2026':16A,19A 'address':14A 'cve':15A,18A 'flock':1A 'home':13A 'leak':9A 'name':11A 'page':8A 'platform':3A 'public':4A 'registr':10A 'safeti':2A 'sign':6A 'sign-up':5A","search_b":"'access':35B 'access-list':34B 'address':71B 'approv':73B 'attack':49B 'captcha':80B 'communiti':52B 'detect':85B 'email':69B 'expos':90B 'featur':40B 'flock':22B,43B 'flock-safeti':21B 'home':70B 'host':25B 'hosted-saa':24B 'imag':86B 'let':46B 'licens':28B,61B 'license-plate-read':27B 'link':57B 'list':36B 'look':63B 'lookup':76B 'name':68B 'person':66B 'plate':29B,62B,83B 'platform':45B 'public':33B 'reader':30B,84B 'regist':60B 'requir':77B 'saa':26B 'safeti':23B,44B 'sign':38B,55B 'sign-up':37B,54B 'solv':78B 'status':74B 'unauthent':48B 'vendor':31B 'video':88B","search_c":"'-06':113C '-10':117C,180C '-22':118C,181C '-23':114C '2026':112C,116C,179C 'access':99C 'access-list':98C 'action':184C 'address':148C,150C 'allow':119C 'approv':152C 'attack':123C 'captcha':159C 'communiti':127C 'custom':183C 'detect':164C 'email':147C 'expos':169C 'exposur':93C 'featur':104C 'flaw':94C 'flock':107C,170C 'home':149C 'host':176C 'imag':165C 'inform':92C 'issu':173C 'licens':139C,161C 'link':133C 'list':100C 'lookup':155C 'name':146C 'plate':140C,162C 'platform':109C 'present':110C 'public':97C,129C 'reader':163C 'regist':136C 'registr':144C 'remedi':171C 'remot':121C 'requir':156C,186C 'retriev':142C 'safeti':108C 'servic':177C 'sign':102C,131C 'sign-up':101C,130C 'solv':157C 'status':153C 'unauthent':122C 'vehicl':137C 'video':167C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124037","severity":null,"published_at":"2026-11-10T16:17:18+00:00","modified_at":"2026-11-10T16:17:18+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}