The vulnerability lies in the /my_assignment/user endpoint of Flowintel. The API accepts a user_id argument but enforces only general authentication, not role checks. Consequently, any authenticated user can retrieve assignment records belonging to any other user by specifying that user's identifier. The exposed data contains task scheduling and assignment details that were intended to be viewable only by administrators or organization administrators. This unauthorized disclosure results in a loss of confidentiality for user assignments.

The affected product is Flowintel Flowintel, specifically version 3.3.0. No other versions or products are mentioned in the advisory.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. Because the attack requires only authenticated API access and no further privileges, the vulnerability can be exploited over the network by any legitimate user who supplies a target user_id. The risk is confined to the confidentiality of assignment data, with no impact on system integrity or availability.