CVE-2026-81819: Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication.
As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier.
The fix changes:
methoddecorators = [apirequired]
to:
methoddecorators = [adminororgadminrequired, apirequired]
so only administrators or organization administrators can perform cross-user assignment queries.
Version impacted =>3.3.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowintelto a version that resolves this vulnerability.Fixed in 3.3.0 - Configuration
Update the /my_assignment/user endpoint method_decorators to remove admin_or_org_admin_required so it matches the fixed behavior: allow only api_required for normal usage, and ensure the cross-user assignment query path is restricted to admins/org admins by using method_decorators = [admin_or_org_admin_required, api_required] where applicable.
Flowintel API endpoint (/my_assignment/user) method_decorators = [api_required]
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated API user with lower privileges may be able to query assignment information for other users by supplying their user_id to the affected endpoint. No administrator or organization-administrator role was required in impacted versions.
Which deployments are affected?
Flowintel versions through 3.3.0 are impacted. The affected behavior applies where authenticated users can access the /my_assignment/user API endpoint.
What access is required to retrieve another user's assignments?
An attacker needs valid API authentication and a target user's identifier. The vulnerable endpoint accepted the user_id parameter without enforcing an administrator or organization-administrator role.
What changes in the fix?
The endpoint now requires both API authentication and either administrator or organization-administrator authorization for cross-user assignment queries. Regular authenticated API users should no longer be able to retrieve other users' assignments through this endpoint.