# CVE-2026-81819: Flowintel unauthorized cross-user assignment access

Source: https://junglewise.ai/threats/cve-2026-81819-flowintel-unauthorized-cross-user-assignment-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81819 · Severity: info · Published 2026-08-27

Flowintel, an intelligence and case management platform, exposed an API endpoint that allowed any authenticated user to view other users' task assignments. By providing another user's identifier, a lower-privileged user could retrieve sensitive assignment information they should not have access to. The vulnerability has been patched by restricting the endpoint to administrators and organization administrators only.

Technologies: [FlowIntel](https://junglewise.ai/threats/technologies/flowintel). Vendors: [FlowIntel](https://junglewise.ai/threats/vendors/flowintel).

## Quick answers

**Is CVE-2026-81819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81819 being exploited in the wild.

**How severe is CVE-2026-81819?** Informational severity, published 27 August 2026.

**Which products and versions are affected?** FlowIntel >=3.3.0.

**Is there a fix for CVE-2026-81819?** A patch was published on 2026-08-18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81819 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81819?** Check whether you run FlowIntel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /my_assignment/user API endpoint in Flowintel versions ≥3.3.0 was protected only by general API authentication (api_required decorator), lacking role-based access control. An attacker could exploit this by making an authenticated API request with a user_id parameter pointing to another user's identifier to retrieve that user's task assignments. The vulnerability required prior API authentication but no other preconditions. The fix adds the admin_or_org_admin_required decorator to restrict endpoint access to administrative users only. The patch was deployed in commit 10ec32e7baa0fa12ffb83bec36d1b4749a428b5c on August 18, 2026.

## Affected products

- Flowintel Flowintel >=3.3.0

## Timeline

- 2026-08-27: disclosed
- 2026-08-18: patched

## References

- [https://github.com/flowintel/flowintel/commit/10ec32e7baa0fa12ffb83bec36d1b4749a428b5c.patch](https://github.com/flowintel/flowintel/commit/10ec32e7baa0fa12ffb83bec36d1b4749a428b5c.patch)

## Related threats

- [flowintel SQL injection in database migration script](https://junglewise.ai/threats/cve-2026-124850-a-sql-injection-vulnerability-exists-in-a-database-migration)
- [Flowintel login email validation bypass leading to log injection](https://junglewise.ai/threats/cve-2026-81827-flowintel-login-email-validation-bypass-leading-to-log-injection)
- [Flowintel session fixation after password change](https://junglewise.ai/threats/cve-2026-81826-flowintel-session-fixation-after-password-change)
- [Flowintel HTML injection in MISP object timeline](https://junglewise.ai/threats/cve-2026-81820-flowintel-html-injection-in-misp-object-timeline)
- [Flowintel authorization bypass in user-edit API](https://junglewise.ai/threats/cve-2026-81818-flowintel-authorization-bypass-in-user-edit-api)