CVE-2026-5022

CVE-2026-5022 identifies an improper authorization vulnerability (CWE-862) in an unspecified product, where the '/api/v1/files/images/{flow_id}/{file_name}' endpoint lacks authentication and authorization checks. This flaw permits unauthenticated attackers to download images associated with any flow by knowing or guessing the flow ID and file name, potentially leading to information disclosure. Rated with a CVSSv4 score of 6.3 (Medium), exploitation requires high attack complexity due to the need for specific knowledge or successful guessing, but can be performed remotely over the network without user interaction or privileges. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.