CVE-2026-50173 Rheosoph CVE debrief

Who should care

Defenders of Flow-Like platform deployments using Azure Blob Storage as the storage backend should assess exposure and prioritize updating to version 1.0.4 or the latest dev branch. App administrators and security teams should review app member permissions and ensure proper segregation of duties.

Why it matters

CVE-2026-50173 is a high-severity vulnerability in the Flow-Like platform that allows app members with 'ExecuteEvents' permission to write or delete blobs under the app content prefix in Azure Blob Storage, even if they lack 'ReadFiles' and 'WriteFiles' permissions. Defenders should prioritize updating to version 1.0.4 or the latest dev branch, review app member permissions, and ensure proper segregation of duties to prevent exploitation.

• App members with 'ExecuteEvents' permission but lacking 'ReadFiles' and 'WriteFiles' permissions can write or delete blobs under the app content prefix.
• Excessive permissions granted by the 'GET /api/v1/apps/{app_id}/invoke/presign' route can lead to unauthorized data modifications or deletions.
• The vulnerability requires verification of app member permissions and Azure Blob Storage configurations to prevent exploitation.
• Updating to version 1.0.4 or the latest dev branch is necessary to patch the issue.

Technical summary

The Flow-Like platform has a vulnerability in versions prior to 1.0.4, where the 'GET /api/v1/apps/{app_id}/invoke/presign' route grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member with 'ExecuteEvents' permission, even if they lack 'ReadFiles' and 'WriteFiles' permissions. This allows low-privilege callers to directly write or delete blobs under the app content prefix.

Defensive priority

High

Recommended defensive actions

• Review and update Flow-Like platform deployments to version 1.0.4 or the latest dev branch if using Azure Blob Storage as the storage backend.
• Restrict 'ExecuteEvents' permission to only those who require it and ensure 'ReadFiles' and 'WriteFiles' permissions are properly set.
• Monitor and audit app member activities for any suspicious write or delete operations on app content.
• Verify app member permissions and Azure Blob Storage configurations to prevent exploitation.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Flow-Like platform versions prior to 1.0.4, which grants excessive permissions to app members with 'ExecuteEvents' permission, allowing them to write or delete blobs under the app content prefix in Azure Blob Storage. The vendor has patched the issue in version 1.0.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.