CVE-2025-55734 - CVE House

Back to Database

Status published Medium CVE-2025-55734

flaskBlo Authorization Bypass

6.9 CVSS

Vulnerability Description

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a user is trying to access the admin page, but that control is not done for the pages routes/adminPanelComments.py and routes/adminPanelPosts.py. Thus, an unauthorized user can bypass the intended restrictions, leaking sensitive data and accessing the following pages: /admin/posts, /adminpanel/posts, /admin/comments, and /adminpanel/comments.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55734

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from DogukanUrker

View All →

flaskBlog arbitrary comment delete

flaskBlog allows arbitrary privilege escalation

flaskBlog Stored XSS Vulnerability

flaskBlog XSS Vulnerability in postContent

User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog

Affected Vendor

DogukanUrker

View all reports →

Affected Software

FlaskBlog

Vulnerable Versions:

<= 2.8.0

Timeline

Official Publish: August 19th, 2025

Last Modified: August 19th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal