PT-2025-33845 · Flaskblog · Flaskblog

Davidedc97 · Published 2025-08-19 · Updated 2025-08-22 · CVE-2025-55734

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: flaskBlog versions 2.8.0 and earlier

Description: The application checks the userRole for "admin" privileges only when accessing the /admin page, but not its subroutes. Specifically, the check is performed in routes/adminPanel.py, but not in routes/adminPanelComments.py and routes/adminPanelPosts.py. This allows unauthorized users to bypass access restrictions and access sensitive data on the following pages: /admin/posts, /adminpanel/posts, /admin/comments, and /adminpanel/comments.

Recommendations: flaskBlog versions prior to 2.8.0: Implement role-based access control checks for all subroutes of the /admin page, including routes/adminPanelComments.py and routes/adminPanelPosts.py, to ensure that only authorized users can access these pages.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-55734

GHSA-H239-VV39-V3VX

GHSA-JW79-2XVP-76P8

Affected Products

Flaskblog

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55734.json · Exploit
• 🔥 https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-h239-vv39-v3vx · Exploit
• 🔥 https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-jw79-2xvp-76p8 · Exploit
• https://osv.dev/vulnerability/CVE-2025-55734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55734 · Security Note
• https://t.me/CVEtracker/30389 · Telegram Post
• https://t.me/cveNotify/133227 · Telegram Post
• https://twitter.com/CVEnew/status/1957883550000140371 · Twitter Post