Authorization Bypass in Flock's Public Safety Platform
CVE-2026-124036

7.6HIGH

Key Information:

Vendor

Flock

Status
Flockos
Vendor
CVE Published:
10 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-124036?

A vulnerability in Flock's hosted public safety platform, FlockOS, prior to September 28, 2026, allowed authenticated users to bypass authorization checks within the visual alert feature. Specifically, users with permissions to manage saved searches could access, modify, or delete saved-search alerts belonging to other organizations if provided with the alert identifier. This allowed for unauthorized changes to alert recipients and even the creation of alerts associated with another organization. Flock has since remediated this issue, ensuring that users can only interact with alerts within their own organizations, mitigating potential misuse of the platform.

Affected Version(s)

FlockOS 0 < 2026-09-28

References

https://www.flocksafety.com/legal/security-advisories
vendor-advisory

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.