Login Request a demo
High severity · published Dec 9, 2021
CVE-2021-41265
Flask-AppBuilder is a development framework built on top of Flask
8.8
CVSS
1.3%
EPSS
No
On KEV
Description
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flask-appbuilder · Dpgaspar
before 3.3.4 · source: NVD
Affected product
FL
Flask-appbuilder
Dpgaspar
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41265
Patch
https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbc
Release Notes
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4
Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q
More from Flask-appbuilder
9.1
CVE-2024-25128
Flask-AppBuilder is an application development framework, built on top of Flask
7.5
CVE-2023-29005
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials
6.5
CVE-2025-58065
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
6.1
CVE-2025-32962
Flask-AppBuilder open redirect vulnerability using HTTP host injection
6.1
CVE-2024-27083
Flask-AppBuilder is an application development framework, built on top of Flask