CVE-2026-81818: Flowintel

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as: “Org admin can change the password of a full admin in the same organization.” The fix adds a higher-privilege boundary check: if user_to_edit.is_admin(): return ... 403 so organization administrators can no longer modify full administrator accounts. Version impacted >=3.3.0

Affected products

• Flowintel Flowintel: up to and including 3.3.0

Published 2026-08-27. Last modified 2026-08-28.