PT-2026-82492

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Flowintel improperly trusts configuration keys provided to the alerts settings update endpoint. While configuration values are normalized to Python literals, the keys are used directly to construc...

PT-2026-82491

Name of the Vulnerable Software and Affected Versions Flowintel affected versions not specified Description An issue exists where attacker-controlled note content is processed by Pandoc and XeLaTeX during PDF export. This can lead to the unauthorized reading of local files from the Flowintel...

PT-2026-82624

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and earlier Description An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case...

PT-2026-82502

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Stored Cross-Site Scripting XSS occurs because calendar event titles are rendered using innerHTML. Since these titles are derived from case titles, a user with permissions to create or modify a ca...

CVE-2026-81659: Improper Limitation of a Pathname to a Restricted Directory

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...

PT-2026-82627

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name,...

PT-2026-82501

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Stored Cross-Site Scripting XSS occurs when Mermaid blocks in case notes are rendered without sufficient neutralization of attacker-controlled markup. An attacker with permissions to create or edi...

PT-2026-82626

Name of the Vulnerable Software and Affected Versions Flowintel version 3.3.0 Description An authorization flaw exists where the '/my assignment/user' API endpoint is accessible to any authenticated API user. The endpoint utilizes a user id parameter to identify the user whose assignments are...

PT-2026-82625

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description An authorization flaw exists in the administrative user-edit API. While the system prevents organization administrators from editing users in different organizations, it fails to restrict them fro...

PT-2026-82500

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Flowintel allows the LOG FILE configuration value to be modified via system settings without restricting it to the intended log directory. This allows an administrator to set LOG FILE to an...

CVE-2026-81818: Improper Privilege Management

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within the...

CVE-2026-81820: Improper Neutralization of Input During Web Page Generation

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2026-69075

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075

FlowIntel is affected by a stored XSS via multiple stored fields that are rendered within Vue templates. An authenticated user can inject Vue interpolation expressions into fields (case/title/ticket/organization/role/profile, etc.). When other users view affected pages, the application may evalua...

CVE-2026-69075

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075 Stored Cross-Site Scripting via Vue Template Injection in FlowIntel

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075 Stored Cross-Site Scripting via Vue Template Injection in FlowIntel

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075 Stored Cross-Site Scripting via Vue Template Injection in FlowIntel

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...

CVE-2026-69075: Improper Neutralization of Input During Web Page Generation

FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were render...