CVE-2025-55736
flaskBlog allows arbitrary privilege escalation
概要
flaskBlog allows arbitrary privilege escalation
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov