CVE WatchAug 27, 2026

CVE-2026-81819

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id par

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 27, 2026 · Last modified: Aug 27, 2026 · CWE-862

EPSS · 30d

Not enough EPSS history yet.

Technical description

Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier. The fix changes: method_decorators = [api_required] to: method_decorators = [admin_or_org_admin_required, api_required] so only administrators or organization administrators can perform cross-user assignment queries. Version impacted =>3.3.0

Official references

github.comhttps://github.com/flowintel/flowintel/commit/10ec32e7baa0fa12ffb83bec36d1b4749a428b5c.patch

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-65931—

—

———LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records. This issue affects LimeSurvey: 7.0.5.5h CVE-2026-813357.5 HIG

—

———Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatch_data_sources in backend/src/baserow/contrib/builder/data_sources/service.py then calls check_multiple_permissions without asking it to raise, and neither stores nor examines the mapping of denials it returns, so a denied check leaves execution to continue and the data source is dispatched whatever the caller's identity. The dispatch runs with the integration's own credentials, so an unauthenticated request naming a data source receives the rows and fields that source reads. Identifiers are small integers and can be enumerated. Version 2.3.1 passes raise_exception to the same call.5h CVE-2026-812795.4 MED

—

———Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.8h CVE-2026-812765.3 MED

—

———Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.15h CVE-2026-812745.3 MED

—

———Subscriber Broken Access Control in Ditty <= 3.1.67 versions.12h CVE-2026-812724.9 MED

—

———Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.12h