CVE-2025-55736criticalCWE-425CWE-807

CVE-2025-55736: critical vulnerability in DogukanUrker FlaskBlog

flaskBlog allows arbitrary privilege escalation

Published

Follow this CVE+ Monitor FlaskBlog

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.3%
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
DogukanUrker · FlaskBlog
Related CVEs — DogukanUrker FlaskBlog

In the same product, most dangerous first.

CVE-2025-55734MEDIUMflaskBlo Authorization BypassEPSS 0.4%CVE-2025-55737MEDIUMflaskBlog arbitrary comment deleteEPSS 0.3%CVE-2025-55735MEDIUMflaskBlog Stored XSS VulnerabilityEPSS 0.2%