PT-2026-82626
CVE-2026-81819
·
Published
2026-08-27
·
Updated
2026-08-28
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Flowintel version 3.3.0
Description
An authorization flaw exists where the '/my assignment/user' API endpoint is accessible to any authenticated API user. The endpoint utilizes a
user id parameter to identify the user whose assignments are retrieved, but it lacks proper role-based access control. This allows a lower-privileged authenticated user to access assignment information of other users by providing their respective identifiers.Recommendations
Update Flowintel version 3.3.0 to a version where the '/my assignment/user' endpoint is restricted to administrators or organization administrators.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾