EUVD-2026-67132
GHSA-m2jr-93w5-4c48
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires already holding a stolen session (AT:P, mapped to AC:H); no attacker authentication of their own so PR:N; high confidentiality and integrity of the account, no availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.
This means that if an attacker already possesses a valid session-for example, from prior access or a stolen session token-the victim changing their password does not terminate that attacker’s access. The session remains usable until it expires naturally. The upstream commit describes this directly as:
“session keeps working until it expires.”
The fix detects password changes and explicitly invokes _invalidate_user_sessions(user.id) after the database update. This is applied in both edit_user_core() and admin_edit_user_core().
Version impacted >=3.3.0
AnalysisAI
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidate existing authenticated sessions when a user changes their password. An attacker who already holds a valid session token (from prior access or theft) keeps full authenticated access to the account even after the victim resets the password, since the old session remains usable until natural expiry. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already possess a valid, active session token/cookie for a target Flowintel account (>=3.3.0) - obtained from prior access, session theft, XSS, a shared/compromised device, or a leaked cookie; this is the AT:P attack requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 9.1 (Critical) is driven by AV:N/PR:N/UI:N with high confidentiality and integrity impact, but the vector also carries AT:P (attack requirement present), which is the crucial nuance: this flaw is not independently exploitable and only matters once an attacker already controls a valid session token. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker obtains a valid Flowintel session token - for example via a stolen cookie, a shared or hijacked browser session, or earlier account access. The victim notices something wrong and changes their password to lock the intruder out, but on unpatched versions (>=3.3.0) the attacker's existing session is never revoked and continues to work until it naturally expires, letting the attacker keep reading cases and modifying data. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor commit https://github.com/flowintel/flowintel/commit/e46e075b8f28212800fc57ead0a7f9a2921bfff0.patch, which adds _invalidate_user_sessions(user.id) after password changes in both edit_user_core() and admin_edit_user_core(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Flowintel deployments and confirm whether version 3.3.0 or later is running; if so, flag as elevated risk and consider restricting Flowintel user access to non-sensitive systems pending remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full adm
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-pr
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrato
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform una
Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, al
Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue i
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines
Server-side request forgery in FlowIntel up to version 3.3.0 allows a low-privileged authenticated user to coerce the ap
Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrie
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inj
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-crea
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious Java
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today