Vulnerability Description
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as: “Org admin can change the password of a full admin in the same organization.” The fix adds a higher-privilege boundary check: if user_to_edit.is_admin(): return ... 403 so organization administrators can no longer modify full administrator accounts. Version impacted >=3.3.0
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-81818?
CVE-2026-81818 is a documented vulnerability. Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing user...
How severe is CVE-2026-81818?
CVSS scoring is not yet available for CVE-2026-81818. Check NVD for updates.
Is there a patch for CVE-2026-81818?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.