CVE-2026-81826

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later

Description Authenticated sessions are not revoked when a user changes their password. This allows an attacker with a valid session token to maintain access to the account until the session expires naturally, even after the password has been updated. The issue occurs within the edit user core() and admin edit user core() functions, where the system fails to call invalidate user sessions(user.id) following a database update.

Recommendations Update Flowintel to a version where the edit user core() and admin edit user core() functions explicitly invoke invalidate user sessions(user.id) upon password changes.