CVE-2026-81826: Flowintel Fails to Invalidate Active Sessions After Password Change
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.
This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that attacker’s access. The session remains usable until it expires naturally. The upstream commit describes this directly as:
“session keeps working until it expires.”
The fix detects password changes and explicitly invokes invalidateusersessions(user.id) after the database update. This is applied in both editusercore() and admineditusercore().
Version impacted >=3.3.0
Affected Software
Event History
Frequently Asked Questions
What must an attacker have to retain access after a password change?
The attacker must already possess a valid authenticated session, such as one obtained through prior access or a stolen session token. A password change alone does not revoke that session.
Which password-change paths are relevant?
The issue applies to password updates performed through both edit_user_core() and admin_edit_user_core(). The fix adds session invalidation after the database update in both paths.
How long can an already-compromised session remain usable?
It remains usable until it expires naturally. The described behavior is that the session continues working after the user’s password has been changed.
How can an administrator verify whether this behavior is present?
Use an authenticated session for a test account, change that account’s password, and check whether the pre-existing session can still access the account. If it remains valid, the session has not been invalidated by the password change.