Affected versions of Flowintel do not terminate authenticated sessions when a user changes their password, allowing an attacker with a valid session token to maintain access. The unchecked session continues until its natural expiry, which can permit ongoing compromise of the victim’s account and data. This weakness entails a high impact on confidentiality, integrity, and availability by enabling attackers to retain control without needing to re‑authenticate.

The vulnerability affects the Flowintel product from the Flowintel vendor. All releases starting at version 3.3.0 are impacted until the session‑invalidation fix is applied. Users running these versions should review their deployment for compatibility with the update.

The CVSS score of 9.1 marks the issue as critical. While the EPSS score is not available, the attack can be carried out with minimal effort by anyone who holds a valid session token, making it highly exploitable. The vulnerability is not yet listed in CISA’s KEV catalog. The fix explicitly calls _invalidate_user_sessions(user.id) after a password change, which removes active sessions immediately. Attackers typically reuse captured or stolen session identifiers, so the primary vector is session token reuse rather than a remote code execution or privilege escalation.