CVE-2026-81817

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and earlier

Description An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case identifier. Consequently, an authenticated user with editor-level access to one case could substitute a task ID from a different case to perform unauthorized operations. This affects endpoints related to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, and external-reference. Additionally, the system did not verify if a note id belonged to the current task during retrieval or export operations.

Recommendations Update to a version later than 3.3.0.