CVE-2026-69075 in FlowIntel
Summary
by MITRE • 08/03/2026
FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields.
Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were rendered inside DOM elements subsequently compiled by Vue. Although normal HTML escaping could neutralize direct HTML markup, it did not prevent an attacker from injecting Vue interpolation expressions using the configured [[ ... ]] delimiters.
An authenticated attacker able to modify one of the affected fields could store a malicious Vue expression. When another user viewed an affected case, report, profile, recurring-case page, or navigation component, Vue could evaluate the injected expression in the context of the FlowIntel application.
Successful exploitation could allow arbitrary JavaScript execution in the victim’s browser under the FlowIntel origin. This could expose information available to the victim, perform actions using the victim’s authenticated session, or modify application data within the victim’s privileges.
The patch introduces a dedicated vue_escape filter that escapes HTML-sensitive characters and breaks Vue interpolation delimiters before the values are rendered. The filter is applied to the affected case, account, organisation, role, configuration, and navigation fields.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
FlowIntel contains a stored cross-site scripting vulnerability that arises from improper handling of user-controlled data within Vue.js templating system. This vulnerability stems from the application's failure to adequately sanitize input values before rendering them in DOM elements that are subsequently processed by Vue's interpolation engine. The flaw affects multiple critical data fields including case titles, ticket identifiers, recurring-case information, user profile attributes, organization names, and role names, all of which are rendered directly within Vue templates without proper sanitization.
The technical implementation of this vulnerability occurs because FlowIntel utilizes Vue.js interpolation delimiters [[ ... ]] for template rendering, while simultaneously allowing users to input data that may contain malicious expressions. Although standard HTML escaping prevents direct HTML injection attacks, it fails to address the specific threat posed by Vue's interpolation syntax. An attacker with authenticated access can inject malicious Vue expressions into any of the affected fields, which then get stored in the application's database and subsequently evaluated when other users view pages containing this data.
The operational impact of this vulnerability is significant as it allows an authenticated attacker to execute arbitrary JavaScript code within the context of any victim's browser session. This creates a persistent threat that can be exploited whenever affected pages are loaded, including case views, reports, user profiles, recurring-case displays, and navigation components. The execution occurs under the FlowIntel application origin, granting the malicious script full access to all resources and data available to the victim within their authenticated session.
This vulnerability directly maps to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') with specific characteristics aligning with CWE-1021: Improper Restriction of Operations within a Single Resource. The attack vector follows ATT&CK technique T1566.001: Phishing via Social Media, where an attacker could manipulate application data to create malicious payloads that execute in legitimate user sessions. Additionally, the vulnerability demonstrates elements of T1213.002: Access Token Manipulation, as successful exploitation could allow attackers to perform actions using victim's authenticated sessions.
The mitigation strategy implemented by FlowIntel addresses this vulnerability through the introduction of a dedicated vue_escape filter that specifically targets both HTML-sensitive characters and Vue interpolation delimiters. This filter ensures that stored values are properly escaped before rendering, effectively breaking any potential Vue interpolation expressions while maintaining the application's functionality. The fix applies the escape filter consistently across all affected data fields including case information, account details, organization names, role definitions, configuration settings, and navigation components, providing comprehensive protection against this class of attack.