EUVD-2026-67125
GHSA-7p7v-2gph-j69j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requires high privileges (org admin); no scope change as impact stays within the application; availability impact is low since the primary harm is credential modification, not disruption.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API.
The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as:
“Org admin can change the password of a full admin in the same organization.”
The fix adds a higher-privilege boundary check:
if user_to_edit.is_admin(): return ... 403
so organization administrators can no longer modify full administrator accounts.
Version impacted >=3.3.0
AnalysisAI
Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full administrator accounts within their own organization, including resetting passwords, effectively enabling account takeover of a higher-privileged identity. Affected versions are 3.3.0 and above, as confirmed by upstream commit ffe64d1133b7d84909a69661bd5fee607e9ce757 which adds the missing role-hierarchy boundary check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess valid organization administrator (org admin) credentials within the target Flowintel instance - this is confirmed by the CVSS PR:H rating and the authorization context described in the patch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L) scores 8.6, reflecting network reachability and high confidentiality/integrity impact, tempered by the high-privilege prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or holds org admin credentials within a Flowintel instance sends a crafted POST request to the administrative user-edit API endpoint, targeting a full administrator account in the same organization. By supplying a new password in the request body, the attacker resets the full admin's credentials and subsequently authenticates as that higher-privileged account. … |
| Remediation | Apply the upstream patch available at https://github.com/flowintel/flowintel/commit/ffe64d1133b7d84909a69661bd5fee607e9ce757.patch, which adds the is_admin() boundary check to the user-edit API handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Flowintel instances running version 3.3.0 or later and audit recent administrator account changes for unauthorized modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidat
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-pr
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrato
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform una
Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, al
Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue i
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines
Server-side request forgery in FlowIntel up to version 3.3.0 allows a low-privileged authenticated user to coerce the ap
Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrie
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inj
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-crea
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious Java
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today