CVE-2026-69075 Details

A stored cross-site scripting vulnerability has been identified in FlowIntel. This issue arises from multiple user-controlled or administrator-controlled fields that allow the injection of malicious Vue interpolation expressions. Affected fields include case titles, ticket identifiers, user profile attributes, organisation names, and role names. Although standard HTML escaping could neutralize direct HTML markup, it failed to prevent the injection of Vue expressions using the configured delimiters. An authenticated attacker who can modify one of the affected fields could store a harmful Vue expression. When another user views the impacted case, report, profile, or navigation component, Vue would execute the injected expression within the FlowIntel application context. This exploitation could lead to arbitrary JavaScript execution in the victim's browser under the FlowIntel origin, potentially exposing information available to the victim, performing actions using the victim's authenticated session, or modifying application data within the victim's privileges.

Users are advised to update to the patched version of FlowIntel, where the vulnerability has been addressed by introducing a dedicated 'vue_escape' filter. This filter escapes HTML-sensitive characters and disrupts Vue interpolation delimiters before the values are rendered. The filter has been applied to the affected case, account, organisation, role, configuration, and navigation fields.