CVE-2026-81819
Received Received - Intake

Information Disclosure in Flowintel via Unauthorized API Access

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: CIRCL

Description
Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier. The fix changes: method_decorators = [api_required] to: method_decorators = [admin_or_org_admin_required, api_required] so only administrators or organization administrators can perform cross-user assignment queries. Version impacted =>3.3.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81819
EUVD
EUVD-2026-67127

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flowintel flowintel 3.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Flowintel allows any authenticated user to access another user's assignment information through the /my_assignment/user API endpoint by providing a user_id parameter. The issue stems from insufficient role restrictions beyond basic API authentication.

Detection Guidance

Check for unauthorized access to the /my_assignment/user API endpoint by reviewing logs for requests with user_id parameters from non-admin users. Look for repeated queries to this endpoint by low-privilege users.

Impact Analysis

A lower-privileged authenticated user could view sensitive assignment data belonging to other users, potentially exposing confidential information or violating data privacy expectations.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating principles of data minimization and access control required by GDPR and HIPAA. It may result in non-compliance with privacy regulations.

Mitigation Strategies

Update Flowintel to a version beyond 3.3.0 where the /my_assignment/user endpoint is restricted to admin or organization admin users. Apply the patch from the official repository if not already updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart