CVE-2026-81818
HighCVSS 8.6Summary
Flowintel versions 3.3.0 and later contain an authorization flaw in the administrative user-edit API. An organization administrator could edit a full administrator account within their own organization, including changing its password. The fix adds a higher-privilege boundary check that returns 403 if the user to edit is an admin.
Risk Assessment
An organization administrator can take over a full administrator account, leading to privilege escalation and compromise of the entire system.
Recommendation
Update Flowintel to a version containing the fix that prevents org admins from modifying full administrator accounts.
Original NVD description (English source)
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as: “Org admin can change the password of a full admin in the same organization.” The fix adds a higher-privilege boundary check: if user_to_edit.is_admin(): return ... 403 so organization administrators can no longer modify full administrator accounts. Version impacted >=3.3.0