Azure Blob Storage Misconfiguration in Flow-Like Platform Affects User Permissions
CVE-2026-50173

7.2HIGH

Key Information:

Vendor

Rheosoph

Status
Flow-like
Vendor
CVE Published:
19 August 2026

What is CVE-2026-50173?

A vulnerability in the Flow-Like platform allows authenticated users with ExecuteEvents permission to gain unauthorized access to Azure Blob Storage. Specifically, the API endpoint /api/v1/apps/{app_id}/invoke/presign provides SAS credentials with write and delete access to app content, bypassing necessary file access permissions. This flaw enables low-privilege users to manipulate blobs, thereby posing a significant risk to data integrity and security. Version 1.0.4 addresses this issue, and users are advised to update immediately if using Azure Blob Storage in self-hosted deployments.

Affected Version(s)

flow-like < 1.0.4

References

https://github.com/Rheosoph/flow-like/security/advisories...
x_refsource_CONFIRM

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.