Insecure Direct Object Reference in Flowintel by Flowintel
CVE-2026-81817

7.2HIGH

Key Information:

Vendor

Flowintel

Status
Flowintel
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81817?

Flowintel versions before 3.3.0 are affected by an insecure direct object reference vulnerability that allows authenticated users with editor-level access to manipulate tasks across different cases. Due to improper verification, users can substitute task IDs from other cases, leading to unauthorized actions on foreign tasks. The recent patch enforces strict checks to ensure task IDs are correctly validated against associated case identifiers, thereby securing various task-related operations. Affected endpoints include those for editing, deleting, and managing task assignments, enhancing overall security integrity.

Affected Version(s)

flowintel 0 <= 3.3.0

References

https://github.com/flowintel/flowintel/commit/10676eec7f1...
patch

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jeroen Pinoy
David Cruciani
.