CVE-2026-81819

Name of the Vulnerable Software and Affected Versions Flowintel version 3.3.0

Description An authorization flaw exists where the '/my assignment/user' API endpoint is accessible to any authenticated API user. The endpoint utilizes a user id parameter to identify the user whose assignments are retrieved, but it lacks proper role-based access control. This allows a lower-privileged authenticated user to access assignment information of other users by providing their respective identifiers.

Recommendations Update Flowintel version 3.3.0 to a version where the '/my assignment/user' endpoint is restricted to administrators or organization administrators.