Flowintel CVE-2026-81827

No special conditions are required beyond network access to the Flowintel login endpoint on a deployment running version 3.3.0 or later. The CVSS vector PR:N confirms no authentication is needed; AC:L and AT:N confirm no race condition or special timing is required. The attacker only needs to submit an HTTP POST with a crafted email parameter - the login itself fails (no application access is gained), but the malformed input is written to logs before rejection. Exploitation is limited to log integrity: the attacker cannot extract data, execute code, or escalate privileges via this path. The primary factor limiting real-world impact is deployment scope - Flowintel installations restricted to internal networks or VPN-gated access have a substantially smaller attacker population than publicly exposed instances.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N accurately reflects that this is a network-accessible, zero-prerequisite integrity flaw with no confidentiality or availability impact. Real-world risk is elevated specifically for organizations that treat Flowintel audit logs as a trusted security record: forged entries could obscure actual intrusion attempts, attribute activity to wrong actors, or break SIEM parsers expecting structured single-line records. EPSS data was not provided in the available intelligence, and the vulnerability does not appear in CISA KEV, indicating no confirmed widespread active exploitation. The attack complexity is genuinely low - no authentication, no special configuration, one HTTP request - but the impact domain is narrow. Defenders should weight the risk against their logging pipeline's role in incident response: organizations using Flowintel audit logs as an authoritative source for compliance or forensic purposes face meaningfully higher practical risk than those using them only informally.

An unauthenticated attacker sends a POST request to the Flowintel login endpoint with an email field value such as attacker@evil.com\r\nINFO 2026-07-23 admin logged in successfully from 10.0.0.1. Because WTForms validation is never actually invoked, the input passes through to the logging layer, where the embedded CRLF causes the single logger.warning() call to produce two physical log lines - the injected second line appearing as a legitimate audit event. A security analyst reviewing post-incident logs would encounter a fabricated entry that could obscure the real attacker's activity or falsely implicate a legitimate user.