Wallabag 2.5.2 Vulnerable to Cross-Site Request Forgery (CSRF) Attacks

CVE-2023-0737

What is CVE-2023-0737?

In Wallabag version 2.5.2, a security flaw exists that allows attackers to exploit Cross-Site Request Forgery (CSRF) vulnerabilities. This issue enables unauthorized deletion of user accounts through the vulnerable /account/delete endpoint. Users are strongly advised to upgrade to version 2.5.4 or later to mitigate this risk effectively. The vulnerability highlights the importance of implementing CSRF tokens and securing endpoints to protect user data and maintain account integrity.

References