CVE-2026-81814
Received Received - Intake

Stored XSS in Flowintel Calendar Event Titles

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: CIRCL

Description
Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. The fix changes: titleEl.innerHTML = arg.event.title to: titleEl.textContent = arg.event.title || '' and similarly stops using innerHTML for the static download icon. Version impacted =>3.3.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81814
EUVD
EUVD-2026-67014

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowintel flowintel 3.3.0
flowintel flowintel to 3.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in a calendar application. It occurs because event titles are rendered using innerHTML, which allows HTML or JavaScript code in user-provided input to be executed in the browser. A user who can create or modify case titles could inject malicious scripts that run when others view the calendar.

Detection Guidance

Check for versions of Flowintel greater than 3.3.0. Inspect calendar.html for use of innerHTML in event title rendering. Look for user-provided input in event titles that may contain HTML or script tags.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary scripts in your browser when viewing calendar events. This might lead to theft of session cookies, account takeover, or unauthorized actions on your behalf. Users with permission to create or modify case titles pose the highest risk.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance violations if user data is compromised due to insufficient input sanitization.

Mitigation Strategies

Update Flowintel to version 3.3.0 or later. Replace innerHTML with textContent for event titles in calendar.html. Ensure user input is properly sanitized before display.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81814. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart