CVE-2025-55734
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-19

Last updated on: 2025-08-22

Assigner: GitHub, Inc.

Description
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a user is trying to access the admin page, but that control is not done for the pages routes/adminPanelComments.py and routes/adminPanelPosts.py. Thus, an unauthorized user can bypass the intended restrictions, leaking sensitive data and accessing the following pages: /admin/posts, /adminpanel/posts, /admin/comments, and /adminpanel/comments.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-19
Last Modified
2025-08-22
Generated
2026-05-27
AI Q&A
2025-08-19
EPSS Evaluated
2026-05-25
NVD
CVE-2025-55734
EUVD
EUVD-2025-25204
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
dogukanurker flaskblog to 2.8.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in flaskBlog versions 2.8.0 and earlier, where the application only checks if a user has the 'admin' role when accessing the /admin page itself, but not when accessing its subroutes such as /admin/posts or /admin/comments. Because the user role check is missing on these subroutes, unauthorized users can bypass access restrictions and view sensitive admin pages that they should not have access to.


How can this vulnerability impact me? :

An attacker or unauthorized user can exploit this vulnerability to access sensitive administrative pages and data without proper authorization. This can lead to leakage of sensitive information and unauthorized actions within the admin sections of the flaskBlog application.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart