CVE-2026-81818 Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges
Organization administrators can reset full administrator passwords, enabling privilege escalation and account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81818?
CVE-2026-81818 is a high-severity vulnerability in flowintel, published on 27 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API.
The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as:
“Org admin can change the password of a full admin in the same organization.”
The fix adds a higher-privilege boundary check:
if user_to_edit.is_admin(): return ... 403
so organization administrators can no longer modify full administrator accounts.
Version impacted >=3.3.0
Weakness: CWE-269
Which versions are affected by CVE-2026-81818?
How do I fix CVE-2026-81818?
No fix has been published for CVE-2026-81818 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81818 being exploited?
There is no known exploitation of CVE-2026-81818 in the wild and no public exploit code.
Sources
Also known as GHSA-7p7v-2gph-j69j.