CVE-2025-55736
flaskBlog allows arbitrary privilege escalation
Résumé
flaskBlog allows arbitrary privilege escalation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov