CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Authenticated users can modify tasks belonging to other cases by manipulating task identifiers, bypassing object-level authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81817?
CVE-2026-81817 is a high-severity missing authorization vulnerability in flowintel, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.
The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task.
The patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints.
The fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths.
Version impacted =>3.3.0
Weakness: CWE-639
Which versions are affected by CVE-2026-81817?
How do I fix CVE-2026-81817?
No fix has been published for CVE-2026-81817 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-81817 being exploited?
There is no known exploitation of CVE-2026-81817 in the wild and no public exploit code.
Sources
Also known as GHSA-ccgv-2jpf-98m2.