Read the docs
TI-2026-56447 Aliases CVE-2026-81818GHSA-7p7v-2gph-j69j

Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges

Priority LOW 39CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as: “Org admin can change the password of a full admin in the same organization.” The fix adds a higher-privilege boundary check: if user_to_edit.is_admin(): return ... 403 so organization administrators can no longer modify full administrator accounts. Version impacted >=3.3.0

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flowintelflowintelup to 3.3.0—No fix listedCNA
  • flowintel Vendorflowintel Affected up to 3.3.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81818
  2. 2026-10-03 Alias added: GHSA-7p7v-2gph-j69j

References

Patch 1

  • TI-2026-56455 Flowintel Fails to Invalidate Active Sessions After Password Change CVSS 4.0CRITICAL 9.1
  • TI-2026-56320 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys CVSS 4.0HIGH 8.6
  • TI-2026-56456 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input CVSS 4.0MEDIUM 6.9
  • TI-2026-56389 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection CVSS 4.0HIGH 7.5
  • TI-2026-56446 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification CVSS 4.0HIGH 7.2
  • TI-2026-56318 Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing CVSS 4.0HIGH 7.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences