Stored Cross-Site Scripting Vulnerability in FlowIntel Software by FlowIntel
CVE-2026-69075

6.9MEDIUM

Key Information:

Vendor

Flowintel

Status
Flowintel
Vendor
CVE Published:
3 August 2026

What is CVE-2026-69075?

FlowIntel is impacted by a stored cross-site scripting vulnerability, which occurs via multiple fields controlled by users or administrators. This vulnerability allows an authenticated attacker to inject malicious Vue expressions into the application, potentially leading to arbitrary JavaScript execution in the context of the application. When another user interacts with certain affected pages or components, the injected code may execute, compromising user data, session integrity, and application behavior. The flaw is addressed by implementing a new vue_escape filter, which properly escapes HTML-sensitive characters and disrupts Vue interpolation delimiters to prevent such injections. Users are encouraged to update to the latest version to mitigate these risks.

Affected Version(s)

flowintel 0 <= 3.3.0

References

https://github.com/flowintel/flowintel/commit/b0e99aa6d27...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Cruciani
Jeroen Pinoy
.