{"id":"CVE-2026-81826","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-81826","summary":"Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.\n\n\nThis means that if an attacker already possesses a valid session—for…","details":"Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.\n\n\nThis means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that attacker’s access. The session remains usable until it expires naturally. The upstream commit describes this directly as:\n\n\n“session keeps working until it expires.”\n\nThe fix detects password changes and explicitly invokes _invalidate_user_sessions(user.id) after the database update. This is applied in both edit_user_core() and admin_edit_user_core().\n\nVersion impacted >=3.3.0","published":"2026-08-27T17:21:05.770","modified":"2026-08-27T17:21:05.770","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/flowintel/flowintel/commit/e46e075b8f28212800fc57ead0a7f9a2921bfff0.patch","label":"flowintel/flowintel@e46e075"},"references":[{"type":"WEB","url":"https://github.com/flowintel/flowintel/commit/e46e075b8f28212800fc57ead0a7f9a2921bfff0.patch"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T17:21:05.770"}}