CVE-2026-81817
Deferred Deferred - Pending Action

Insecure Direct Object Reference in Flowintel Task Endpoints

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: CIRCL

Description
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task. The patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints. The fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths. Version impacted =>3.3.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-09-17
AI Q&A
2026-08-27
EPSS Evaluated
2026-09-15
NVD
CVE-2026-81817
EUVD
EUVD-2026-67123

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flowintel flowintel 3.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure direct object reference or broken object-level authorization issue in Flowintel's task management system. It allows authenticated users with editor-level access to one case to manipulate tasks belonging to other cases by substituting task IDs. The system did not verify if a task belonged to the requested case before performing operations.

Detection Guidance

To detect this vulnerability, review application logs for unauthorized task access attempts. Check for requests where a user with editor-level access to one case attempts to modify or access tasks from another case. Look for 404 errors or unexpected task operations across endpoints like edit, delete, note, assignment, status, file, export, or MISP-linking.

Impact Analysis

An attacker with editor access could view, edit, delete, or export tasks from other cases they are not authorized to access. This includes manipulating task notes, files, assignments, and subtasks, potentially leading to data leaks or unauthorized modifications.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by allowing unauthorized access to sensitive task data. It undermines principles of least privilege and data segregation, potentially leading to compliance breaches and legal consequences.

Mitigation Strategies

Apply the patch from the Flowintel repository that introduces the task_case_bound_required decorator to enforce task-case binding. Ensure all task-related endpoints are updated to validate task ownership before allowing operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart