Unauthorized Access in Flowintel API for User Assignments

CVE-2026-81819

What is CVE-2026-81819?

The Flowintel application exposes the /my_assignment/user API endpoint to all authenticated API users, allowing them to access sensitive assignment information of other users without proper role restrictions. This vulnerability arises because the endpoint accepts a user_id parameter, enabling lower-privileged users to query data about higher-privileged users. The recent fix enhances the security by enforcing that only administrators or organization administrators can perform these cross-user assignment queries, thus preventing unauthorized access to sensitive user data.

References