Is CVE-2022-24776 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-24776 being exploited in the wild.

How severe is CVE-2022-24776?

Low severity, with a CVSS score of 3.1, published 2 July 2026.

Which products and versions are affected?

flask-appbuilder (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.5.

Is there a fix for CVE-2022-24776?

Yes. flask-appbuilder (PyPI): upgrade to 3.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-24776 attacked?

It is attacked over the network.

Am I affected by CVE-2022-24776?

Check whether you run flask-appbuilder (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-24776: PYSEC-2026-635 - Open Redirect in Flask-AppBuilder

CVE-2022-24776 · Severity: low · CVSS 3.1 · Published 2026-07-02

Flask-AppBuilder is a Python framework for rapidly building web applications on top of Flask. The database authentication login page contains an open redirect vulnerability that allows an attacker to redirect users to arbitrary external websites. An attacker could craft a malicious link to trick users into visiting phishing pages or other untrusted sites, compromising user credentials or spreading malware.

Technologies: flask-appbuilder (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-24776 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-24776 being exploited in the wild.
How severe is CVE-2022-24776?: Low severity, with a CVSS score of 3.1, published 2 July 2026.
Which products and versions are affected?: flask-appbuilder (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.5.
Is there a fix for CVE-2022-24776?: Yes. flask-appbuilder (PyPI): upgrade to 3.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-24776 attacked?: It is attacked over the network.
Am I affected by CVE-2022-24776?: Check whether you run flask-appbuilder (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

flask-appbuilder (PyPI): upgrade to 3.4.5 or later
```
pip install "flask-appbuilder>=3.4.5"
```

Technical details

Flask-AppBuilder versions prior to 3.4.5 contain a CWE-601 open redirect vulnerability in the database authentication login page. The application accepts user-controlled input that specifies a redirect URL and uses it without proper validation or sanitization. The vulnerability is exploitable via the network with no authentication required, but user interaction is necessary (user must click a crafted link). An attacker can redirect authenticated users to an untrusted external site. The fix is available in version 3.4.5 and later.

Affected products

Flask-AppBuilder Flask-AppBuilder before 3.4.5

Identifiers

CVE-2022-24776
GHSA-2ccw-7px8-vmpf
PYSEC-2026-635

Timeline

2022-03-24: disclosed: Security advisory published
2022-03-25: patched: Version 3.4.5 released with fix

References

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.