CVE-2026-81818: Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API.
The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as:
“Org admin can change the password of a full admin in the same organization.”
The fix adds a higher-privilege boundary check:
if usertoedit.isadmin(): return ... 403
so organization administrators can no longer modify full administrator accounts.
Version impacted >=3.3.0
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A Flowintel organization administrator can exploit it against a full administrator account in the same organization. The flaw does not permit the organization administrator to edit users in another organization.
What level of access can exploitation provide?
The organization administrator can change the full administrator's password through the administrative user-edit API. This can allow the organization administrator to take over that full administrator account and escalate privileges.
Are affected deployments vulnerable by default?
Affected Flowintel versions are vulnerable when an organization administrator and a full administrator belong to the same organization, because the vulnerable authorization check allowed the organization administrator to edit that full administrator account.
What mitigation is indicated by the fix?
Prevent organization administrators from modifying accounts identified as full administrators in the administrative user-edit API. The upstream fix returns a 403 response when the user being edited is a full administrator.