Flowintel CVE-2026-81818

Exploitation requires the attacker to possess valid organization administrator (org admin) credentials within the target Flowintel instance - this is confirmed by the CVSS PR:H rating and the authorization context described in the patch. The flaw is only reachable via the authenticated administrative user-edit API endpoint (POST). The limiting factors are: (1) the attacker must already be authenticated as an org admin, ruling out unauthenticated external actors; (2) the target must be a full administrator account within the same organization - cross-organization targeting is blocked by the pre-existing authorization check; (3) the instance must be running Flowintel >= 3.3.0. No special non-default configuration is required beyond having both org admin and full admin accounts co-existing in the same organization, which is a normal deployment state.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L) scores 8.6, reflecting network reachability and high confidentiality/integrity impact, tempered by the high-privilege prerequisite. The PR:H rating is the most important limiting factor: exploitation requires an actor who already holds org admin credentials within the Flowintel instance. No EPSS data was provided in the input, and the vulnerability is absent from the CISA KEV catalog, meaning no confirmed active exploitation is known. No public proof-of-concept code has been identified. The realistic threat model centers on a malicious or compromised org admin performing internal privilege escalation to seize full administrator control - a meaningful insider-threat or post-compromise scenario rather than an external opportunistic attack. The high CVSS score is defensible given the potential blast radius (full admin takeover), but organizations should weigh it against the high-privilege entry requirement when prioritizing patching. EPSS is not available in the provided data; exploitation probability cannot be independently calculated.

An attacker who has obtained or holds org admin credentials within a Flowintel instance sends a crafted POST request to the administrative user-edit API endpoint, targeting a full administrator account in the same organization. By supplying a new password in the request body, the attacker resets the full admin's credentials and subsequently authenticates as that higher-privileged account. No public proof-of-concept code exists at time of analysis, but the attack requires only standard HTTP API interaction.