CVE-2025-55737 flaskBlog arbitrary comment delete

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code...

CVE-2025-55737

CVE-2025-55737 affects flaskBlog versions prior to 2.8.0. The root cause is missing ownership validation when deleting comments, enabling any user to delete another user’s comment by intercepting the delete request and altering the commentID in routes/post.py. Documents consistently describe the ...