Executive brief
Flowintel, a threat intelligence and incident response platform, contains a privilege escalation flaw in its administrative user management API. Organization administrators could modify full administrator accounts within their organization, including changing passwords and potentially taking over admin accounts. This allows an insider threat to escalate privileges beyond their intended scope.
Technical details
The vulnerability is an authorization bypass in the user-edit API endpoint (app/admin/admin_api.py). The authorization check correctly prevented organization administrators from editing users in other organizations, but failed to prevent them from editing full administrator accounts within their own organization. The root cause is a missing privilege boundary check: when an org admin attempts to modify a full admin, the code did not verify the target user's admin status. An authenticated organization administrator can exploit this by sending a PATCH/POST request to the user-edit API with credentials of a full admin and parameters to modify (e.g., password change). The fix adds an explicit check: if the target user has admin privileges, org admins receive a 403 Forbidden response. No exploitation in the wild has been reported.
Affected products
- Flowintel Flowintel >=3.3.0
Timeline
- 2026-08-27: disclosed
- 2026-08-18: patched