CVE-2026-81817: Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.
The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task.
The patch introduces taskcaseboundrequired, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints.
The fix also adds explicit checks that a requested noteid belongs to the current task before returning or exporting it, closing related cross-object access paths.
Version impacted =>3.3.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowintelto a version that resolves this vulnerability.Fixed in 3.3.0 - Configuration
Ensure the patch logic task_case_bound_required is applied so endpoints load both the case and task objects and return 404 unless the task belongs to the requested case; apply this check across edit/delete/note/assignment/status/file/export/MISP-linking/subtask/external-reference and other task-related routes that receive both case identifier and task identifier.
Flowintel task endpoints task_case_bound_required = enabled - Configuration
Add/ensure an explicit check that requested note_id belongs to the current task before returning or exporting it to close related cross-object access paths.
Flowintel task notes note ownership check = enforced
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user needs editor-level access to at least one case. That access could be used to target tasks associated with a different case by substituting a foreign task ID.
Which operations may be exposed?
The affected task endpoints include editing, deletion, notes, assignment, status changes, files, exports, MISP linking, subtasks, and external references. Related note retrieval and export paths were also affected when a note_id was not verified as belonging to the current task.
Which deployments are affected?
Flowintel versions later than 3.3.0 are identified as impacted. The provided data does not specify a fixed version.
How does the fix prevent cross-case access?
The fix adds task_case_bound_required, which loads the case and task and returns 404 when the task does not belong to the requested case. It also verifies that requested notes belong to the current task before they are returned or exported.