EUVD-2026-67133
GHSA-3hq8-r684-4qwf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable login form requires no authentication; integrity impact is limited to log file manipulation with no scope change beyond the vulnerable system.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object.
Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries.
The patch corrects the validation call to Email()(form, form.email), changes the standard logging call to parameterized logging, and introduces _sanitize_log_fragment() so carriage returns and line feeds are encoded instead of creating new records.
Version impacted >=3.3.0
AnalysisAI
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines by supplying email values containing CR/LF characters at the login endpoint. The vulnerability traces to a misuse of WTForms validation - the code constructed a validator object via Email(email) without invoking it, leaving attacker-controlled input unsanitized before it was interpolated into both the standard warning logger and the custom audit logger via Python f-strings. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network access to the Flowintel login endpoint on a deployment running version 3.3.0 or later. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N accurately reflects that this is a network-accessible, zero-prerequisite integrity flaw with no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a POST request to the Flowintel login endpoint with an email field value such as attacker@evil.com\r\nINFO 2026-07-23 admin logged in successfully from 10.0.0.1. Because WTForms validation is never actually invoked, the input passes through to the logging layer, where the embedded CRLF causes the single logger.warning() call to produce two physical log lines - the injected second line appearing as a legitimate audit event. … |
| Remediation | Update Flowintel to the version incorporating commit 660b4cc405055a794f157d3e4612520f12fe85bf (https://github.com/flowintel/flowintel/commit/660b4cc405055a794f157d3e4612520f12fe85bf); a specific tagged release version was not confirmed in the available data, so verify the target release includes this commit before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidat
Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full adm
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-pr
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrato
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform una
Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, al
Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue i
Server-side request forgery in FlowIntel up to version 3.3.0 allows a low-privileged authenticated user to coerce the ap
Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrie
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inj
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-crea
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious Java
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today