CVE-2025-55736

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.

CVSS v4.0

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 18th percentile

Published

2025-08-19

Proof-of-concept exploits (1)

• DogukanUrker/FlaskBlog/security/advisories/GHSA-6q83-vfmq-wf72

References

• CVE Record
• NVD entry

Related

• CVE-2024-22414
• CVE-2025-28101
• CVE-2025-28102
• CVE-2025-28104
• CVE-2025-55734
• CVE-2025-55735