Improper Email Validation in Flowintel Affects User Authentication

CVE-2026-81827

What is CVE-2026-81827?

Flowintel versions 3.3.0 and above present a vulnerability where the application fails to adequately validate login email addresses. The flawed implementation of email validation allows attackers to input malformed email addresses during the login process. This can result in those inputs being logged into security-relevant logs without proper filtering, as the application does not escape CR/LF characters. Consequently, an unauthenticated attacker could exploit this weakness to inject additional log entries or craft misleading log information. The recent patch addresses these issues by correcting the validation method, transitioning to parameterized logging practices, and introducing a new method to sanitize log fragments, which ensures that carriage returns and line feeds are encoded correctly.

References