Description (CNA)
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within their own organization. As a result, an org admin could modify that full administrator account, including changing its password. The upstream commit explicitly describes the issue as: “Org admin can change the password of a full admin in the same organization.” The fix adds a higher-privilege boundary check: if user_to_edit.is_admin(): return ... 403 so organization administrators can no longer modify full administrator accounts. Version impacted >=3.3.0
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| flowintel / flowintel | affected 0 through 3.3.0 |
CWE
CWE-269
References
ADP enrichment
No English description supplied.
No references supplied.