Description
A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a cross‑site request forgery (CSRF) in Flask‑MonitoringDashboard. Remote attackers can create requests that the server treats as authenticated, enabling execution of actions the victim’s account is allowed to perform. The CVE notes that some unknown functionality is affected, meaning the exact reach of the impact is not detailed in the description. The weakness types are CWE‑352 and CWE‑862.

Affected Systems

Any installation of Flask‑MonitoringDashboard version up to 5.0.2. The affected product is flask‑dashboard’s Flask‑MonitoringDashboard web‑based monitoring interface.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% shows that exploitation is considered very unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be remote, requiring the attacker to send crafted requests. Given the moderate score and low exploitation probability, the overall risk is present but can be mitigated by applying a patch or applying other mitigations. This vulnerability is classified as CWE‑352 and CWE‑862.

Generated by OpenCVE AI on July 26, 2026 at 18:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Flask‑MonitoringDashboard to a version newer than 5.0.2.
  • Enable CSRF protection for all non‑GET routes, for example by using Flask‑WTF or Flask‑Seasurf.
  • If an upgrade is not immediately possible, restrict access to the dashboard to authenticated administrators only and disable or secure any actions that lack CSRF tokens.

Generated by OpenCVE AI on July 26, 2026 at 18:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title flask-dashboard Flask-MonitoringDashboard cross-site request forgery
First Time appeared Flask-dashboard
Flask-dashboard flask-monitoringdashboard
Weaknesses CWE-352
CWE-862
CPEs cpe:2.3:a:flask-dashboard:flask-monitoringdashboard:*:*:*:*:*:*:*:*
Vendors & Products Flask-dashboard
Flask-dashboard flask-monitoringdashboard
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Flask-dashboard Flask-monitoringdashboard
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-08T14:21:20.699Z

Reserved: 2026-07-08T07:38:11.295Z

Link: CVE-2026-15034

cve-icon Vulnrichment

Updated: 2026-07-08T14:21:17.686Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T18:15:17Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

  • CWE-862

    Missing Authorization