CVE-2021-41265

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
dpgaspar	Flask-AppBuilder	< 3.3.4

References

https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbcPatch, Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4Release Notes, Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66qThird Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbcPatch, Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4Release Notes, Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66qThird Party Advisory

Timeline

Published: Dec 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412669.8Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versi CVE-2021-412676.5Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP com CVE-2021-412688.8Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP compon CVE-2021-412699.8cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected vers CVE-2021-41279.8An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thu CVE-2021-412706.5Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a CVE-2021-412715.3Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cac CVE-2021-412727.5Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations r CVE-2021-412734.3Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on CVE-2021-412748.8solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_CVE-2021-412758.8spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront frame CVE-2021-412767.2Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does