CVE-2026-69075

Name of the Vulnerable Software and Affected Versions FlowIntel (affected versions not specified)

Description FlowIntel contains a stored cross-site scripting issue where multiple user-controlled or administrator-controlled fields are rendered inside DOM elements compiled by Vue. While standard HTML escaping is present, it fails to prevent the injection of Vue interpolation expressions using [[ ... ]] delimiters. An authenticated attacker can store a malicious Vue expression in fields such as case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names. When another user views the affected component, Vue evaluates the expression, allowing arbitrary JavaScript execution under the FlowIntel origin. This can lead to unauthorized information exposure, actions performed using the victim's session, or modification of application data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.