CVE-2026-81827

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81827
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81827.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81827
Published
2026-08-27T13:36:19Z
Modified
2026-08-30T03:30:15Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input
Details

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object.

Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries.

The patch corrects the validation call to Email()(form, form.email), changes the standard logging call to parameterized logging, and introduces _sanitize_log_fragment() so carriage returns and line feeds are encoded instead of creating new records.

Version impacted >=3.3.0

Database specific 
{
    "cna_assigner": "CIRCL",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81827.json"
}
References

Affected packages

Git / github.com/flowintel/flowintel

Affected ranges

Type
GIT
Repo
https://github.com/flowintel/flowintel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
660b4cc405055a794f157d3e4612520f12fe65bf
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.1
0.1.0
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.8.0
1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
2.*
2.0.0
2.1.0
2.1.1
2.2.1
2.3.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81827.json"