CVE-2026-81818
2026-08-27
17h21 +00:00
17h21 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API.
The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as:
“Org admin can change the password of a full admin in the same organization.”
The fix adds a higher-privilege boundary check:
if user_to_edit.is_admin(): return ... 403
so organization administrators can no longer modify full administrator accounts.
Version impacted >=3.3.0
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Improper Privilege Management The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
