https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:03:19 +0000 https://cve.radiocsirt.org/vuln/cve-2026-81817 <p><strong>Affected:</strong> flowintel</p> <p>Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.</p> <p>The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task.</p> <p>The patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints.</p> <p>The fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths.</p> <p>Version impacted =&gt;3.3.0</p> <p><strong>Affected:</strong> flowintel</p> <p>Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.</p> <p>The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task.</p> <p>The patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints.</p> <p>The fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths.</p> <p>Version impacted =&gt;3.3.0</p> https://cve.radiocsirt.org/vuln/cve-2026-81817