CVE-2025-55736

critical · 9.3

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.

9.3

CVSS

0.3%

EPSS (exploit prob.)

19th

EPSS percentile

2025-08-19

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-425CWE-807

Affected products

Vendor	Product	Affected versions
dogukanurker	flaskblog	<= 2.8.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-6q83-vfmq-wf72

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-55736