CVE-2025-55737 — flaskBlog arbitrary comment delete
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrar…
Published: 2025-08-19 · CVSS: 6.9 · CVSS 4.0
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7