CVE-2026-81659

Affected versions of Flowintel do not revoke existing authenticated sessions when a user's password is changed. An attacker with a valid session retains access until it expires. The fix detects password changes and explicitly invalidates user sessions after the database update, applied in edit_user_core() and admin_edit_user_core(). Versions >=3.3.0 are affected.

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email), which does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries.

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as object UUID, object name, attribute value, attribute type, comment, first/last seen values, and IDS flag. Those values were concatenated directly into HTML strings before rendering. The upstream commit explicitly states that DOMPurify removed XSS vectors but still allowed other HTML elements, such as forms, through.

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier.

Flowintel versions 3.3.0 and later contain an authorization flaw in the administrative user-edit API. An organization administrator could edit a full administrator account within their own organization, including changing its password. The fix adds a higher-privilege boundary check that returns 403 if the user to edit is an admin.

Flowintel versions 3.3.0 and later contain an insecure direct object reference (IDOR) issue across numerous task endpoints. Routes did not enforce that a task belonged to the supplied case, allowing an authenticated user with access to one case to manipulate tasks from another case. The patch adds task_case_bound_required and checks that note_id belongs to the current task.

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. The fix changes innerHTML to textContent.

Vulnerability in Flowintel allows JavaScript injection via malicious Mermaid blocks in case notes. An attacker with note creation or edit permissions can store a crafted payload that executes for other users.

Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOG_FILE to an arbitrary filesystem path. Since attackers can influence logged content, this enables controlled data to be written into unintended files. The upstream commit specifically describes an exploitation chain in which an attacker injects a template into a chosen file and subsequently abuses application rendering behavior to execute code. The patch removes LOG_FILE from the web-editable settings, introduces validate_log_file_name() to reject absolute paths, traversal, Windows paths, null bytes, and directory components, and centralizes log path construction through resolve_log_file_path(). Version impacted: >=3.3.0

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py. The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment: f'{key} = {py_val}' and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. Version impacted >=3.3.0