CVE-2021-41265 Improper Authentication in Flask-AppBuilder

What is CVE-2021-41265?

CVE-2021-41265 is a high-severity authentication bypass vulnerability in dpgaspar Flask-AppBuilder, published on 9 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.

Weakness: CWE-287

Which versions are affected by CVE-2021-41265?

3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.

Products include Dpgaspar Flask-Appbuilder.

How do I fix CVE-2021-41265?

Upgrade flask-appbuilder to 3.3.4 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-41265 being exploited?

There is no known exploitation of CVE-2021-41265 in the wild and no public exploit code.

Other vulnerabilities in dpgaspar Flask-AppBuilder

• CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID Critical 9.1
• CVE-2023-29005 No Rate Limiting on Login AUTH DB High 7.5
• CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder High 7.2
• CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods Medium 6.5
• CVE-2022-24776 Open Redirect in Flask-AppBuilder Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m3rf-7m4w-r66q, PYSEC-2021-851.