Flowintel EUVD-2026-67127

Exploitation requires valid Flowintel API authentication (an active account satisfying the api_required decorator). No elevated role is needed - any standard authenticated API user is sufficient. The attacker must know or enumerate a valid user_id belonging to another user; depending on Flowintel's ID scheme, sequential integers may be trivially guessable. The vulnerability is limited to the /my_assignment/user endpoint and yields only assignment-related metadata for the targeted user. Exploitation is impossible without prior authentication and does not affect users on systems where the patched decorator (admin_or_org_admin_required) has been applied. No specific non-default configuration is required - any Flowintel deployment running an unpatched version with multiple user accounts is exposed by default.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) accurately reflects a moderate, narrow-impact issue: network-reachable, low-complexity, but requiring prior authentication and delivering only limited confidentiality exposure. No EPSS data was provided, and the vulnerability is absent from CISA KEV, suggesting no observed mass exploitation. The missing-authorization class (CWE-862) is straightforward to discover through API enumeration but yields only assignment metadata - not credentials, session tokens, or high-value secrets - limiting the damage radius. Real-world risk is further constrained by Flowintel's niche deployment base (primarily CERT/CSIRT organizations). The primary concern is insider threat or lateral movement within a multi-tenant Flowintel instance where user isolation is expected. A version discrepancy exists in the source data: the CVE description states 'Version impacted =>3.3.0' (implying ≥3.3.0), while EUVD-2026-67127 states '≤3.3.0'; the EUVD range is treated as authoritative here, but consumers should verify with the vendor.

An authenticated Flowintel user with standard API credentials issues a GET request to /my_assignment/user with a user_id parameter set to the identifier of a higher-privileged colleague or administrator. The endpoint returns that user's assignment records without checking whether the caller has admin or org-admin privileges. No public proof-of-concept exists, but the attack requires only knowledge of another user's numeric identifier, which may be enumerable or observable within the same organization's workflow.