CVE-2025-28104

The attacker sends a specially crafted request to a vulnerable endpoint in the FlaskBlog application, bypassing access control mechanisms. The error classified as CWE-284 (Improper Access Control) indicates that the application does not properly verify the requester's permissions before returning sensitive data. As a result, it is possible to unauthorized read all usernames stored in the system without possessing any account or session.

The attacker obtains a complete list of usernames in the application, which can serve as a starting point for further attacks, such as brute-force password attacks or phishing targeted at specific users. User data confidentiality and integrity are compromised.

Apply patches available from the vendor according to the references. It is recommended to monitor the GitHub repository of the project (https://github.com/DogukanUrker/flaskBlog/issues/130) for information about the release of the patched version. Until the patch is applied, consider restricting access to vulnerable endpoints at the firewall or reverse proxy level.

FlaskBlog v2.6.1 by Dogukanurker