Executive brief
Flowintel, an intelligence and case management platform, exposed an API endpoint that allowed any authenticated user to view other users' task assignments. By providing another user's identifier, a lower-privileged user could retrieve sensitive assignment information they should not have access to. The vulnerability has been patched by restricting the endpoint to administrators and organization administrators only.
Technical details
The /my_assignment/user API endpoint in Flowintel versions ≥3.3.0 was protected only by general API authentication (api_required decorator), lacking role-based access control. An attacker could exploit this by making an authenticated API request with a user_id parameter pointing to another user's identifier to retrieve that user's task assignments. The vulnerability required prior API authentication but no other preconditions. The fix adds the admin_or_org_admin_required decorator to restrict endpoint access to administrative users only. The patch was deployed in commit 10ec32e7baa0fa12ffb83bec36d1b4749a428b5c on August 18, 2026.
Affected products
- Flowintel Flowintel >=3.3.0
Timeline
- 2026-08-27: disclosed
- 2026-08-18: patched