CVE-2026-81818

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later

Description An authorization flaw exists in the administrative user-edit API. While the system prevents organization administrators from editing users in different organizations, it fails to restrict them from modifying full administrator accounts within their own organization. This allows an organization administrator to change the password of a full administrator, leading to privilege escalation. The issue is addressed by implementing a privilege boundary check using the is admin() function to block these modifications.

Recommendations Update Flowintel to a version where the is admin() boundary check is implemented in the user-edit API to prevent organization administrators from modifying full administrator accounts.