Flowintel EUVD-2026-66997

Exploitation requires a valid authenticated session with high-privilege access (PR:H per the provided CVSS 4.0 vector) to the Flowintel instance - specifically, authorization to call the alerts settings update endpoint. Unauthenticated and low-privilege users cannot reach the vulnerable code path. The target must be running Flowintel version 3.3.0 or later. The application process must have filesystem write access to conf/config_module.py, which is a standard deployment requirement and therefore expected in any default installation. No non-default configuration is required - any default Flowintel deployment of an affected version with the alerts feature active is vulnerable once high-privilege credentials are obtained. Exploitation is limited by: (1) the mandatory admin credential requirement; (2) network reachability to the Flowintel web interface; (3) absence of the vendor patch.

The CVSS 4.0 score of 8.6 with PR:H reflects that exploitation is gated behind high-privilege authentication, which materially reduces the realistic attacker population compared to unauthenticated vulnerabilities of similar impact. Once that gate is passed, however, exploitation is low-complexity (AC:L, AT:N) and delivers full confidentiality, integrity, and availability compromise of the vulnerable component (VC:H/VI:H/VA:H). No EPSS data was included in the provided intelligence, and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation at time of analysis; no public proof-of-concept has been identified. The primary realistic threat vectors are credential compromise of an admin account, insider threat, or a chained attack that escalates privilege to then reach this endpoint. The network attack vector (AV:N) means any reachable Flowintel instance is in scope once credentials are obtained - even a mid-sized security operations team with an internet-exposed deployment should treat this as urgent given that RCE is the outcome. The vendor patch is available and the fix is straightforward; residual risk is low for patched instances.

An attacker who has obtained valid high-privilege Flowintel credentials - through phishing, credential reuse against an exposed login page, or insider access - sends a crafted POST request to the alerts settings update endpoint with a configuration key embedding a newline and arbitrary Python (for example, 'WEBHOOK_ENABLED import subprocess; subprocess.Popen(["bash","-i","-c","..."])). Flowintel writes the tampered content into conf/config_module.py and calls importlib.reload(), executing the injected code in the running server process. The attacker achieves code execution with the privileges of the Flowintel process without any further interaction.