FlowIntel is vulnerable to a stored cross-site scripting (XSS) issue via multiple user-controlled or administrator-controlled fields. Malicious Vue interpolation expressions can be injected and executed in the context of the application when viewed by other users. This allows arbitrary JavaScript execution, potentially exposing sensitive information or enabling actions with the victim's privileges. The vulnerability affects fields such as case titles, ticket identifiers, user profiles, and organization names. A patch introducing a vue_escape filter to neutralize Vue interpolation delimiters has been implemented but no explicit patch availability is confirmed in this data.