CVE-2026-81814

Executive Summary

CVE-2026-81814 is a stored cross-site scripting (XSS) vulnerability in Flowintel, an application that facilitates case management and calendar functionality. Versions up to and including 3.3.0 are vulnerable. The flaw exists because calendar event titles, which are derived from case titles, are rendered using the innerHTML DOM property. This allows a user with the ability to create or modify a case title to inject HTML or JavaScript content that is later executed in the context of another user's browser session when they view the calendar. The impact is a persistent, authenticated attack vector enabling session hijacking, data exfiltration, or arbitrary actions performed on behalf of the victim. No CVSS score has been assigned, no public exploit code exists, and the vulnerability is currently considered unpatched with no patch evidence from tracked sources.

Technical Analysis

The vulnerability resides in the client-side rendering logic of Flowintel's calendar view. The NVD description provides a precise code-level insight into the flaw mechanism. The affected code previously executed the following assignment:

titleEl.innerHTML = arg.event.title

This assignment takes the title property of an event object (arg.event.title) and writes it directly into the Document Object Model (DOM) using the innerHTML setter. The innerHTML property parses the assigned string as HTML markup, meaning that any HTML tags embedded within the string are interpreted and rendered by the browser. Critically, this includes <script> tags (in some contexts) and event handler attributes such as onerror or onload, which can execute JavaScript automatically.

The threat model is compounded by data flow. The calendar event titles are "derived from case titles." This means the flow of tainted data is: a user creates or modifies a case title → that title propagates to a calendar event object → the event title is rendered via innerHTML in another user's browser. This is a classic stored XSS pattern, as the malicious payload persists in the application's data store (the case title) and executes later when a different user loads the calendar view.

The NVD description also indicates that the fix involves changing the assignment to:

titleEl.textContent = arg.event.title || ''

The textContent property treats the assigned value as plain text, preventing HTML parsing. The || '' fallback handles null or undefined event titles gracefully. Furthermore, the fix "similarly stops using innerHTML for the static download icon," indicating that the same unsafe pattern was used elsewhere in the same view and is being rectified.

The attack surface is the calendaring module of Flowintel, specifically the function that populates the calendar event list. The preconditions for exploitation are: (1) an authenticated user with the permission to create or modify case titles, and (2) another authenticated user who views the calendar. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting).

Exploitation Scenarios

No public PoC or exploit code is available for this vulnerability; the following attack chain is inferred from the vulnerability class and the details provided in the NVD description.

Step 1: Reconnaissance and Target Identification An attacker begins by identifying a Flowintel instance running version 3.3.0 or earlier. This can be accomplished through banner grabbing, observing the login page fingerprint, or using the Shodan dorks provided. The attacker then authenticates with a valid account. The account must possess the necessary privilege to create or modify a case title. In many case-management platforms, this is a standard user privilege, making the attack feasible for low-privileged users.

Step 2: Triggering the Vulnerability (Storing the Payload) The attacker navigates to the case creation or case editing functionality. In the "title" field, the attacker injects a malicious payload. Rather than a benign title, the attacker submits a string containing HTML and JavaScript. A representative payload at the class level would include HTML with an inline event handler, such as an image tag with an onerror handler, or a crafted SVG element. The server-side application does not sanitize or neutralize this input at the storage layer. The malicious title is saved to the persistent data store. This step completes the "stored" phase of the stored XSS.

Step 3: Execution in the Victim's Browser A different user (the victim) logs into Flowintel and navigates to the calendar view. The application retrieves the list of calendar events from the server. For each event, it constructs an event object. The title property of one of these event objects contains the attacker's payload (derived from the malicious case title). The client-side JavaScript builds the calendar view and executes the vulnerable assignment: titleEl.innerHTML = arg.event.title. The browser parses the attacker's string as HTML. If the payload includes JavaScript (e.g., via an onerror attribute that fires when an image fails to load), it executes immediately in the context of the victim's session.

Step 4: Post-Exploitation Impact Once the payload executes, the attacker's script runs with the victim's privileges and origin. Common post-exploitation actions include: stealing session cookies and sending them to an attacker-controlled server; capturing the victim's clipboard or keystrokes; performing actions on behalf of the victim (e.g., modifying or deleting cases, creating new users if the victim is an admin); or injecting a keylogger. The persistence of the payload means every user who views the calendar is compromised, potentially leading to broad account takeover across the organization.

Impact Assessment

The business impact of CVE-2026-81814 is significant due to the stored and persistent nature of the XSS. Unlike reflected XSS, which requires a victim to click a crafted link, stored XSS delivers the payload with no further interaction from the victim beyond normal application usage. The affected system is any deployment of Flowintel running version 3.3.0 or earlier, which is the version range confirmed as vulnerable.

The attack prerequisites are low: an attacker needs only a low-privileged authenticated account that can create or modify cases. This significantly broadens the potential threat actor pool to include malicious insiders, external contractors with limited accounts, or compromised user accounts. The blast radius is equally broad, as the calendar view is likely a central dashboard feature used by most, if not all, users of the application.

No CVSS vector or score is available. However, based on the characteristics described, the vulnerability would likely score in the High range (7.0–8.5) if assessed, factoring in a network attack vector, low attack complexity, low privileges required, and high impact to confidentiality and integrity. The confidentiality impact is high because session tokens and sensitive data (case contents) can be exfiltrated. The integrity impact is high because the attacker can perform state-changing operations on behalf of the victim. The availability impact is low. The lack of a formal CVSS score complicates risk-based prioritization, but the functional impact of a stored XSS in a collaborative case-management tool should not be underestimated.

Detection Guidance

The following detection rules focus on identifying indicators of stored XSS payloads in application logs, network traffic, and system events. Since this is a client-side rendering issue, network-level detection is primarily relevant for identifying the exfiltration of stolen data following a successful exploit, while application log analysis is key for detecting the initial payload injection.

Sigma Rule

title: Stored XSS Payload in Case Title - Flowintel
id: 6d9e0e63-62f8-4b8a-92a5-1d8a2c184076
status: experimental
description: Detects attempts to store JavaScript payloads in case title fields, indicating exploitation of CVE-2026-81814
logsource:
  product: flowintel
  category: application
detection:
  selection:
    EventType: "CaseModified"
    FieldName: "title"
    NewValue|contains:
      - "<script"
      - "javascript:"
      - "onerror="
      - "onload="
      - "<svg"
      - "<img"
  condition: selection
level: high
falsepositives:
  - Legitimate HTML formatting in titles (rare, but possible)
tags:
  - attack.t1190
  - cve.2026.81814

YARA Rule

rule Flowintel_Stored_XSS_Payload
{
    meta:
        author = "ValtersIT SOC"
        date = "2026-01-15"
        description = "Detects stored XSS payload strings targeting Flowintel case titles"
        cve = "CVE-2026-81814"
    strings:
        $s1 = "titleEl.innerHTML" ascii wide
        $s2 = "onerror=" ascii wide
        $s3 = "<script>" ascii wide
        $s4 = "javascript:" ascii wide
        $s5 = "onload=" ascii wide
    condition:
        uint16(0) == 0x5A4D and any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81814 - Flowintel Stored XSS Payload Injection (POST)"; flow:established,to_server; content:"POST"; http_method; content:"case"; http_uri; nocase; content:"title="; http_client_body; nocase; pcre:"/(<script|javascript:|onerror=|onload=)/i"; sid:2026818; rev:1; metadata:created_at 2026-01-15, cve CVE-2026-81814;)

Elastic Detection

sequence by user.name with maxspan=1m
  [any where process.name : "flowintel*" and event.action : "case_update" and
   stringContains(process.command_line, "title=") and
   stringContains(process.command_line, "<script>") or
   stringContains(process.command_line, "onerror=")]
  [network where destination.port == 53 or destination.ip == "your_exfil_ip"]

Splunk SPL Query

index=flowintel sourcetype="flowintel:change"
| where like(_raw, "%onerror=%") OR like(_raw, "%<script>%") OR like(_raw, "%javascript:%")
| table _time user src_ip CaseTitle NewValue
| stats count by user src_ip

Wazuh OSSEC Rule

<group name="web, stored_xss,">
  <rule id="100081" level="15">
    <decoded_as>json</decoded_as>
    <field name="eventType">CaseModified</field>
    <field name="fieldname">title</field>
    <regex>onerror=|&lt;script&gt;|javascript:</regex>
    <description>Flowintel: Possible stored XSS payload in case title (CVE-2026-81814)</description>
    <group>stored_xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status Warning: Patch confidence is 0/4, indicating that no patch evidence has been found in any tracked source. The NVD description indicates that a fix has been developed (replacing innerHTML with textContent), but no vendor advisory, commit hash, or released version has been confirmed by the tracked patch sources. Organizations should consider the vulnerability unpatched and act accordingly.

1) Immediate Mitigations:

• Restrict user permissions: Limit the ability to create or modify case titles to only trusted administrators. This reduces the attack surface by removing the preconditions for exploitation. If an account is compromised, this mitigation limits the blast radius.
• Web Application Firewall (WAF) rules: Deploy WAF rules to filter outbound HTTP requests containing XSS payload patterns (e.g., <script>, onerror=, javascript:). This provides a layer of defense that may block payloads from being stored.
• Monitor logs: Increase monitoring of case title modifications and calendar view access. Look for anomalies in title data, such as the presence of HTML tags.

2) Patch/Upgrade Steps:

• There is no vendor-provided patch or upgrade available at this time. Monitor the official Flowintel project channels (GitHub repository, project website, security mailing list) for a security release.
• The NVD description provides the exact code change required (innerHTML → textContent). If your organization maintains a fork or has the technical capability to apply hotfixes, apply the change described in the NVD entry to the JavaScript file responsible for rendering calendar events. Also ensure the related fix for the "static download icon" is applied.

3) Long-Term Hardening:

• Input validation and output encoding: Implement a robust Content Security Policy (CSP) that disallows inline scripts. A strict CSP can prevent the execution of injected JavaScript even if the XSS flaw is exploited.
• Sanitization library: Introduce a server-side HTML sanitization library (e.g., DOMPurify on the client or an equivalent on the server) to neutralize HTML in case titles before storage.
• Security testing: Add a persistent XSS test case to your CI/CD pipeline that targets the calendar rendering logic to prevent regression.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-81814
2. CWE-79 (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
3. Flowintel Project (verify for vendor advisory): https://github.com/Flowintel/flowintel (Note: verify URL; vendor advisory not confirmed as of this writing)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (No entry listed for CVE-2026-81814 as of the time of writing)

Threat Actor Campaigns / Exploit-in-the-Wild: No known threat actor campaigns or in-the-wild exploitation have been identified for this vulnerability. The absence of a public PoC and a formal CVSS score suggests the vulnerability may have been discovered through responsible disclosure and is not yet leveraged in targeted attacks. However, the unpatched status increases the risk of future exploitation as details become more widely known.