Authorization Bypass in Flowintel Allows Org Admin to Modify Full Admin Accounts

Executive Summary

This vulnerability is an authorization flaw in Flowintel's administrative user-edit API. It allows an organization administrator to modify a full administrator account within their own organization, including changing its password. The issue occurs because the existing authorization check prevents editing users in other organizations but fails to block modifications to other admins in the same organization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized modifications to admin accounts by reviewing logs for API calls to the administrative user-edit endpoint. Look for 403 errors in the logs when org admins attempt to edit full admin accounts within the same organization.

Useful 0 Not Useful 0

Impact Analysis

An attacker with organization admin privileges could escalate their access by changing the password of a full administrator account. This could grant them higher privileges, allowing them to perform unauthorized actions, access sensitive data, or disrupt system operations within the organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, violating data protection requirements in GDPR and HIPAA. It undermines access control principles, potentially resulting in non-compliance with regulatory mandates for data security and user access management.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply the patch from the provided commit to enforce the higher-privilege boundary check. Ensure no unauthorized admin account modifications have occurred by auditing recent changes to admin credentials and permissions.

Useful 0 Not Useful 0