CVE-2026-81827

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later

Description An issue exists where login email addresses are incorrectly validated. The system calls Email(email), which only constructs a validator object instead of performing actual WTForms field validation. This allows malformed, attacker-controlled email input to proceed through the login process and be written to security-relevant logs, including a warning log and a custom audit logger. Because carriage return (CR) and line feed (LF) characters are not escaped, an unauthenticated attacker can perform log injection by inserting additional physical log lines or forging misleading log entries.

Recommendations For versions 3.3.0 and later, update the software to the patched version that corrects the validation call to Email()(form, form.email), implements parameterized logging, and utilizes the sanitize log fragment() function to encode carriage returns and line feeds.