The vulnerability arises because Flowintel attempts to validate email addresses by calling a constructor of the Email validator instead of performing WTForms validation. This misuses the API so that malformed, attacker‑controlled email input bypasses validation and reaches the login flow, where it is written directly to warning and audit logs. Because carriage return and line feed characters are not escaped, an unauthenticated attacker could inject additional physical log lines or forge misleading entries, compromising the integrity of security logs and potentially facilitating future detection evasion.

The affected product is Flowintel, version 3.3.0 and newer. Any deployment of Flowintel that has not applied the patch detailed in the referenced commit is susceptible. The vulnerability is present in login handling code that logs the supplied email address to security‑relevant logs.

The CVSS assessment gives a score of 6.9, indicating medium severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an unauthenticated user submitting a crafted email address via the public login page. Exploitation would not grant code execution but could corrupt audit and warning logs, thereby undermining incident response and forensic reliability.