Authorization Flaw in Flowintel Affects Organizational User Management

CVE-2026-81818

What is CVE-2026-81818?

Flowintel versions starting from 3.3.0 have a critical authorization flaw that permits organization administrators to modify full administrator accounts within their own organization. Although the checks in place prevent admins from accessing users in other organizations, they inadvertently allow alterations to full admin accounts, including password changes. The introduction of a higher-privilege boundary check effectively mitigates this risk by blocking such unauthorized modifications.

References