CVE-2026-81827
MediumCVSS 6.9Summary
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email), which does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries.
Risk Assessment
The risk includes the possibility of log manipulation by an unauthenticated attacker, which could hide attacks or mislead security personnel. It could also allow injection of fake log entries.
Recommendation
It is recommended to update Flowintel to a version containing the fix that properly validates email addresses and escapes CR/LF characters. Also, review existing logs for suspicious entries.
Original NVD description (English source)
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries. The patch corrects the validation call to Email()(form, form.email), changes the standard logging call to parameterized logging, and introduces _sanitize_log_fragment() so carriage returns and line feeds are encoded instead of creating new records. Version impacted >=3.3.0