CVE-2025-55736

9.3 criticalEPSS 0.3%

Critical (9.3) in dogukanurker flaskblog. EPSS 0.3% chance of exploitation in the next 30 days.

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWEs: CWE-425, CWE-807
Published: 2025-08-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dogukanurker:flaskblog

References

https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-6q83-vfmq-wf72

Check your stack JSON