Vulnerability Description
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dogukanurker | Flaskblog | <= 2.8.0 |
Related Weaknesses (CWE)
References
- https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-6hp9-jv2f-88wExploitThird Party Advisory
FAQ
What is CVE-2025-55737?
CVE-2025-55737 is a vulnerability with a CVSS score of 6.5 (MEDIUM). flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another us...
How severe is CVE-2025-55737?
CVE-2025-55737 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-55737?
Check the references section above for vendor advisories and patch information. Affected products include: Dogukanurker Flaskblog.