CVE-2026-81817— Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Quick assessment
Affected
flowintel flowintel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Flowintel 受影响的版本中存在不安全的直接对象引用/对象级授权失效问题，影响众多任务端点。 这些路由通常同时接收案件标识符和任务标识符，但此前并未强制验证该任务是否确实属于所给定的案件。因此，对某个案件拥有编辑者权限的已认证用户，可能替换为另一个案件中任务的ID，并针对该外部任务执行操作。 该补丁引入了 ，它会加载这两个对象，并在任务不属于所请求的案件时返回 404。这一保护措施已应用于编辑、删除、备注、分配、状态、文件、导出、MISP 链接、子任务、外部引用以及其他与任务相关的端点。 修复还添加了显式检查
Possible ATT&CK Techniques 1 AI
T1210.001
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81817
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.
The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task.
The patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints.
The fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths.
Version impacted =>3.3.0
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-81817
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81817
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-81817 (1)
Same Patch Batch · flowintel · 2026-08-27 · 11 CVEs total
| CVE-2026-81826 | 9.1 CRITICAL | Flowintel Fails to Invalidate Active Sessions After Password Change |
| CVE-2026-81662 | 8.6 HIGH | Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configur |
| CVE-2026-81818 | 8.6 HIGH | Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Pr |
| CVE-2026-81743 | 7.5 HIGH | Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection |
| CVE-2026-81659 | 7.1 HIGH | Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing |
| CVE-2026-81827 | 6.9 MEDIUM | Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input |
| CVE-2026-81819 | 5.3 MEDIUM | Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignm |
| CVE-2026-81814 | 5.1 MEDIUM | Flowintel Stored XSS in Calendar via Malicious Case Title |
| CVE-2026-81753 | 5.1 MEDIUM | Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content |
| CVE-2026-81820 | 5.1 MEDIUM | Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes |
IV. Related Vulnerabilities
Same product: flowintel
-
CVE-2026-81827
Flowintel Login Email Validation Bypass Allows Log Injection -
CVE-2026-81826
Flowintel Fails to Invalidate Active Sessions After Password -
CVE-2026-81820
Flowintel HTML Injection in MISP Case History Timeline via C -
CVE-2026-81819
Flowintel Missing Authorization Allows Regular API Users to -
CVE-2026-81818
Flowintel Organization Administrator Can Reset Full Administ
Same vendor: flowintel
-
CVE-2026-81827
Flowintel Login Email Validation Bypass Allows Log Injection -
CVE-2026-81826
Flowintel Fails to Invalidate Active Sessions After Password -
CVE-2026-81820
Flowintel HTML Injection in MISP Case History Timeline via C -
CVE-2026-81819
Flowintel Missing Authorization Allows Regular API Users to -
CVE-2026-81818
Flowintel Organization Administrator Can Reset Full Administ
Same weakness: CWE-639
-
CVE-2026-4398
Authorization Bypass Through User-Controlled Key in GitLab -
CVE-2026-81668
Rubygem-katello: cross-tenant content view filter rule acces -
CVE-2026-17562
IDOR in Zirve Security's AdisyonPro -
CVE-2026-81658
Foreman: cross-tenant disclosure of template revisions via u -
CVE-2026-81576
Improper Authentication of Session Handles
V. Comments for CVE-2026-81817
No comments yet