# CVE-2023-52555: mongo-express Cross-Site Request Forgery in admin interface

Source: https://junglewise.ai/threats/cve-2023-52555-mongo-express-cross-site-request-forgery-in-admin-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-03-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-52555 · Severity: low · CVSS 3.1 · Published 2024-03-01

mongo-express is a web-based MongoDB administration tool used to manage databases. An attacker can trick an authenticated admin into performing sensitive actions—such as deleting database collections—by making them click a malicious link or visit a compromised webpage. This can result in unintended data loss or database corruption.

Technologies: [mongo-express (npm)](https://junglewise.ai/threats/technologies/npm-mongo-express). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-52555 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-52555 being exploited in the wild.

**How severe is CVE-2023-52555?** Low severity, with a CVSS score of 3.1, published 1 March 2024.

**Which products and versions are affected?** mongo-express (npm) SEMVER:introduced=0,last_affected=1.0.2.

**Is there a fix for CVE-2023-52555?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-52555 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-52555?** Check whether you run mongo-express (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF, CWE-352) in the /admin endpoint of mongo-express. The admin interface performs sensitive operations (e.g., collection deletion) without validating CSRF tokens or verifying that requests originated from the legitimate application. An attacker can craft a malicious HTML page that submits a forged POST request to delete database tables when a logged-in admin visits it, requiring only that the admin be authenticated and click the link (user interaction required). No patch availability information is mentioned in the advisory details.

## Affected products

- mongo-express mongo-express 1.0.2 and earlier

## Identifiers

- CVE-2023-52555
- GHSA-fffg-cwc9-xvj7

## Timeline

- 2023-11-13: disclosed: Vulnerability reported on GitHub issue #1338
- 2024-03-01: advisory: Published as CVE-2023-52555 and GHSA-fffg-cwc9-xvj7

## References

- [https://github.com/mongo-express/mongo-express/issues/1338](https://github.com/mongo-express/mongo-express/issues/1338)

## Related threats

- [mongo-express denial of service in CSV export](https://junglewise.ai/threats/cve-2021-23372-mongo-express-denial-of-service-in-csv-export)
- [mongo-express multiple cross-site scripting vulnerabilities](https://junglewise.ai/threats/cve-2021-21422-mongo-express-multiple-cross-site-scripting-vulnerabilities)
- [mongo-express remote code execution in index creation](https://junglewise.ai/threats/cve-2019-10758-mongodb-mongo-express-remote-code-execution-vulnerability)