{"id":"CVE-2022-39038","aliases":["EUVD-2022-41584","GHSA-jgxr-2v2p-f979"],"status":"published","title":"FLOWRING Agentflow BPM - Broken Access Control","description":"Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01029,"percentile":0.64089,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2022-11-10T02:20:46Z","modified":"2026-06-17T04:57:28Z","products":[{"vendor":"flowring","product":"agentflow"},{"vendor":"flowring","product":"agentflow bpm"}],"references":[{"url":"https://www.flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e5%ae%89%e4%bf%ae%e6%ad%a3/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.twcert.org.tw/tw/cp-132-6684-53149-1.html","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39038"},{"url":"https://github.com/advisories/GHSA-jgxr-2v2p-f979"}],"sources":{"cve":[{"id":"CVE-2022-39038","title":"FLOWRING Agentflow BPM - Broken Access Control","description":"Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.","status":"published","published":"2022-11-10T02:20:46.42Z","modified":"2025-05-01T19:06:11.492Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2022-41584","description":"Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.","status":"published","published":"2022-11-10T02:20:46Z","modified":"2025-05-01T19:06:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:51:56.360543Z"}],"ghsa":[{"id":"GHSA-jgxr-2v2p-f979","title":"Agentflow BPM enterprise management system has improper authentication. A remote attacker with...","description":"Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.","status":"published","published":"2022-11-10T19:01:09Z","modified":"2023-01-27T05:03:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:42:15.698999Z"}],"nvd":[{"id":"CVE-2022-39038","description":"Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.","status":"published","published":"2022-11-10T15:15:14.647Z","modified":"2026-06-17T04:57:28.62Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:31.914793Z"}]}}