What’s Vulnerable › Vulnerabilities

CVE-2023-0737: CSRF in wallabag/wallabag

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-11-15 · updated 2026-06-17
• Weakness: CWE-352

Description

wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

Affected products

• wallabag/wallabag: 2.5.2

References

• https://github.com/wallabag/wallabag/commit/268372dbbdd7ef87b84617fdebf95d0a86caf7dc
• https://huntr.com/bounties/4ba20fe7-4061-4dfb-ab2f-ecaf110641a5

Get alerted when CVE-2023-0737 or the next vulnerability affects your stack