CVE-2026-4215
MEDIUMFlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery
Title source: cnaDescription
A security flaw has been discovered in FlowCI flow-core-x up to 1.23.01. The impacted element is the function Save of the file core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java of the component SMTP Host Handler. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
CVSS v3
6.3
EPSS
0.0004
EPSS Percentile
13.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-918
Status
published
Products (1)
FlowCI/flow-core-x
1.23.01
Published
Mar 16, 2026
Tracked Since
Mar 16, 2026