Session Management Vulnerability in Flowintel Product by Flowintel

CVE-2026-81826

What is CVE-2026-81826?

Flowintel versions 3.3.0 and higher are susceptible to a vulnerability where changing a user's password does not invalidate existing authenticated sessions. An attacker with prior access or possessing a stolen session token can maintain their access even after the victim updates their password, allowing continued exploitation until the session expires naturally. The issue arises from the system not detecting password changes and failing to invalidate user sessions accordingly. A patch has been implemented to address this oversight, ensuring that password changes trigger the necessary procedures to terminate all active sessions.

References