CVE-2026-69075
Received Received - Intake

Stored XSS in FlowIntel Application

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were rendered inside DOM elements subsequently compiled by Vue. Although normal HTML escaping could neutralize direct HTML markup, it did not prevent an attacker from injecting Vue interpolation expressions using the configured [[ ... ]] delimiters. An authenticated attacker able to modify one of the affected fields could store a malicious Vue expression. When another user viewed an affected case, report, profile, recurring-case page, or navigation component, Vue could evaluate the injected expression in the context of the FlowIntel application. Successful exploitation could allow arbitrary JavaScript execution in the victim’s browser under the FlowIntel origin. This could expose information available to the victim, perform actions using the victim’s authenticated session, or modify application data within the victim’s privileges. The patch introduces a dedicated vue_escape filter that escapes HTML-sensitive characters and breaks Vue interpolation delimiters before the values are rendered. The filter is applied to the affected case, account, organisation, role, configuration, and navigation fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69075
EUVD
EUVD-2026-52253

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flowintel flowintel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FlowIntel has a stored cross-site scripting (XSS) vulnerability in multiple fields like case titles, user profiles, and organization names. Attackers can inject malicious Vue.js expressions using [[ ... ]] delimiters. When rendered, these expressions execute arbitrary JavaScript in the victim's browser under FlowIntel's origin.

Detection Guidance

Check for suspicious user-controlled fields like case titles, profile attributes, or organisation names containing Vue interpolation expressions (e.g., [[ ... ]]). Inspect DOM elements rendered by Vue for unexpected JavaScript execution or modified application data.

Impact Analysis

An authenticated attacker could modify affected fields to store malicious code. When other users view pages with these fields, their browsers could execute the attacker's JavaScript. This may expose sensitive data, perform actions on their behalf, or alter application data within their privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as user information or application data, due to arbitrary JavaScript execution in the victim's browser. This may violate GDPR's data protection principles or HIPAA's security requirements for protecting health information.

Mitigation Strategies

Apply the patch introducing the vue_escape filter to escape HTML-sensitive characters and break Vue interpolation delimiters. Ensure all affected fields (case, account, organisation, role, configuration, navigation) are updated with the filter applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart