CVE-2022-39038: Flowring Agentflow

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.

Affected products

• Flowring Agentflow: version 4.0.0.1183.552 only

Published 2022-11-10. Last modified 2026-06-17.