CVE-2026-81827: Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object.
Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries.
The patch corrects the validation call to Email()(form, form.email), changes the standard logging call to parameterized logging, and introduces sanitizelogfragment() so carriage returns and line feeds are encoded instead of creating new records.
Version impacted >=3.3.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowintelto a version that resolves this vulnerability.Fixed in 3.3.0 - Configuration
Update the login email validation logic to call the WTForms validator with the form and form.email (use Email()(form, form.email)); do not call Email(email), which bypasses WTForms field validation.
Flowintel login email validation Email call corrected from Email(email) to Email()(form, form.email) = Email()(form, form.email) - Configuration
Change warning logging and custom audit logger writes to use parameterized logging instead of inserting attacker-controlled email text directly into log strings.
Flowintel logging Standard logging changed to parameterized logging = parameterized logging - Configuration
Implement and use _sanitize_log_fragment() for attacker-controlled log fields so carriage return (CR) and line feed (LF) characters are encoded rather than creating new log records.
Flowintel logging Sanitize log fragments to encode CR/LF = encode carriage returns and line feeds (CR/LF) via _sanitize_log_fragment()
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can submit crafted email input to the login process. Successful exploitation depends on being able to send email values containing carriage return or line feed characters.
What is the impact on logs?
The supplied email could be written to both a warning log and the custom audit logger without CR/LF escaping. This may allow injected physical log lines or misleading forged log entries in security-relevant logs.
Which deployments are affected?
Flowintel versions 3.3.0 and later are identified as impacted. The issue is in the login email validation and logging path, so deployments exposing that login functionality are relevant.
What does the fix change?
The patch invokes WTForms email validation correctly, uses parameterized standard logging, and sanitizes log fragments by encoding carriage returns and line feeds.