CVE-2026-81818

Technical Description

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API.

The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as:

“Org admin can change the password of a full admin in the same organization.”

The fix adds a higher-privilege boundary check:

if user_to_edit.is_admin(): return ... 403

so organization administrators can no longer modify full administrator accounts.

Version impacted >=3.3.0

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References