EUVD-2026-67014
GHSA-pw4w-qcm7-cgq8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate as low-privileged Flowintel user
-
DeliveryCreate or edit case with XSS payload in title
-
ExploitPayload persisted in case store
-
InstallVictim navigates to calendar view
-
C2FullCalendar renders title via innerHTML
-
ExecuteMalicious script executes in victim's browser context
-
ImpactSession token or sensitive data exfiltrated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold a Flowintel account with sufficient privileges to create or modify case titles (PR:L per CVSS 4.0). The victim must passively view the Flowintel calendar (UI:P) - simply loading the calendar page triggers rendering of all event titles via the vulnerable innerHTML sink. Flowintel version 3.3.0 or later must be deployed. No special network position or non-default configuration is required beyond the calendar feature being in use, which is a core product view. Limiting factors: attackers without case-create or case-edit rights cannot plant the payload; users who never access the calendar view are not exposed; the impact is bounded to the browser session of the calendar-viewing user rather than server-side integrity. |
| Impact | The CVSS 4.0 score of 5.1 (Medium) accurately reflects the bounded real-world risk: exploitation requires a low-privileged authenticated user (PR:L) and passive victim interaction via calendar viewing (UI:P), limiting the attack surface compared to a fully unauthenticated or zero-click flaw. The scope change (SC:L/SI:L) captures cross-user impact - a successful payload can steal session tokens or perform actions on behalf of the calendar-viewing victim. EPSS data is not available in the provided intelligence, so exploitation probability cannot be numerically quantified. No KEV listing and no public exploit code are recorded, placing this in the 'no public exploit identified' category. The combination of low privileges required and the stored-XSS pattern makes this exploitable by any insider or low-trust user of the platform; incident-response teams using Flowintel for case tracking should treat this as urgent given the sensitivity of data in such environments. |
| Exploit ScenarioDerived | An authenticated Flowintel user with case-creation privileges creates a case with a title containing a JavaScript payload such as a session-cookie exfiltration script. When any other authenticated user navigates to the Flowintel calendar view, the FullCalendar rendering engine assigns the malicious title via innerHTML, causing the browser to execute the script and potentially exfiltrate the victim's session token to an attacker-controlled endpoint. No public exploit code has been identified, but the vulnerability is mechanically trivial to reproduce given knowledge of the affected code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-creation or case-editing privileges to inject arbitrary HTML or JavaScript into case titles, which is then executed in the browser of any user who views the calendar. The root cause is unsanitized assignment of user-controlled strings to titleEl.innerHTML. No public exploit has been identified at time of analysis, but the fix is available as an upstream commit and the vulnerability is straightforward to reproduce by any authenticated user.
RemediationAI
Apply the upstream fix available at https://github.com/flowintel/flowintel/commit/f224438eb495e6b0d4e465eb7f40ab771bbfdb66.patch, which replaces innerHTML assignments with textContent for user-derived calendar titles and switches to safe DOM element creation for static icons. Operators running Flowintel >= 3.3.0 should rebuild from the patched commit or await a tagged release from the maintainer. As a compensating control prior to patching, restrict case-creation and case-editing permissions to fully trusted users only, reducing the pool of principals capable of injecting payloads - note this does not eliminate risk if any trusted user account is compromised. Content Security Policy headers that block inline script execution would reduce XSS impact but require careful tuning to avoid breaking Flowintel's own JavaScript.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Flowintel is an open-source case and incident management platform. The affected code resides in app/templates/calendar/calendar.html, where FullCalendar event rendering uses the DOM property innerHTML to assign event titles derived directly from case titles. CWE-79 (Stored XSS) applies: user-supplied input is persisted (in the case title field) and later injected into a DOM sink without sanitization. The CPE cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:* with version constraint >= 3.3.0 covers all affected releases. A secondary innerHTML usage for a download icon was also corrected in the same commit, though that instance does not depend on user input. The fix replaces innerHTML with textContent for the title and uses safe DOM element creation (createElement, classList.add, appendChild) for the icon.
Know when Flowintel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Network-reachable stored XSS requiring low-privilege write access and victim calendar interaction; scope changes to affect other authenticated users' sessions.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
DescriptionCVE.org
Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.
The fix changes:
titleEl.innerHTML = arg.event.title
to:
titleEl.textContent = arg.event.title || ''
and similarly stops using innerHTML for the static download icon.
Version impacted =>3.3.0
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidat
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-pr
Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full adm
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrato
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform una
Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, al
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines
Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue i
Server-side request forgery in FlowIntel up to version 3.3.0 allows a low-privileged authenticated user to coerce the ap
Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrie
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious Java
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inj
Exploit-DB