Quick answers
- Is CVE-2026-81819 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81819 being exploited in the wild.
- How severe is CVE-2026-81819?
- Informational severity, published 27 August 2026.
- Which products and versions are affected?
- FlowIntel >=3.3.0.
- Is there a fix for CVE-2026-81819?
- A patch was published on 2026-08-18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81819 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-81819?
- Check whether you run FlowIntel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The /my_assignment/user API endpoint in Flowintel versions ≥3.3.0 was protected only by general API authentication (api_required decorator), lacking role-based access control. An attacker could exploit this by making an authenticated API request with a user_id parameter pointing to another user's identifier to retrieve that user's task assignments. The vulnerability required prior API authentication but no other preconditions. The fix adds the admin_or_org_admin_required decorator to restrict endpoint access to administrative users only. The patch was deployed in commit 10ec32e7baa0fa12ffb83bec36d1b4749a428b5c on August 18, 2026.
Affected products
- Flowintel Flowintel >=3.3.0
Timeline
- 2026-08-27: disclosed
- 2026-08-18: patched