Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification

Description

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task. The patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints. The fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths. Version impacted =>3.3.0

Scores

EPSS (exploitation in 30 days)

0.35% · top 71% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

• CWE-639 Authorization Bypass Through User-Controlled Key (opens in a new tab)All about CWE-639 and its CVEs

Affected products

• flowintel · flowintel

  • affected ≤ 3.3.0

References (1)

• https://github.com/flowintel/flowintel/commit/10676eec7f1286d7ee0769546c772c5cb9c1c72b.patch (opens in a new tab)patch

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-81817](https://trackcve.app/badge/CVE-2026-81817.svg)](https://trackcve.app/cve/CVE-2026-81817)

Record last updated 27 Aug 2026, 19:44 UTC.