CVE-2026-81819
MediumCVSS 5.3Summary
Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier.
Risk Assessment
The risk includes unauthorized access to other users' assignment information, which could breach data confidentiality and security policies. A lower-privileged user could obtain data they should not have access to.
Recommendation
It is recommended to update Flowintel to a version containing the fix that restricts access to the endpoint to administrators or organization administrators only. Also review user permissions.
Original NVD description (English source)
Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier. The fix changes: method_decorators = [api_required] to: method_decorators = [admin_or_org_admin_required, api_required] so only administrators or organization administrators can perform cross-user assignment queries. Version impacted =>3.3.0