CVE-2025-28104 Missing authorization in n/a

What is CVE-2025-28104?

CVE-2025-28104 is a critical missing authorization vulnerability in n/a, published on 21 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.

Weakness: CWE-284

Which versions are affected by CVE-2025-28104?

It affects 1 product.

Products include Dogukanurker Flaskblog.

How do I fix CVE-2025-28104?

No fix has been published for CVE-2025-28104 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-28104 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-28104 exists.

Other vulnerabilities in n/a

• CVE-2025-55736 flaskBlog allows arbitrary privilege escalation Critical 9.3
• CVE-2025-55734 flaskBlo Authorization Bypass Medium 6.9
• CVE-2025-55737 flaskBlog arbitrary comment delete Medium 6.9
• CVE-2025-28101 Cross-site request forgery in n/a Medium 6.5
• CVE-2024-22414 User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rfhg-52gw-r6hv.