Executive brief
Flask-MonitoringDashboard is a tool used to track the performance and health of Python web applications. A security flaw allows an attacker to trick a logged-in administrator into unknowingly creating a new administrative account for the attacker. This could lead to a full takeover of the monitoring dashboard, exposing sensitive operational data and application performance metrics.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the /api/user/create endpoint of Flask-MonitoringDashboard up to version 5.0.2. The application lacks CSRF token validation and does not enforce SameSite cookie attributes, relying solely on session cookies for authorization in the admin_secure decorator. By tricking an authenticated administrator into visiting a malicious webpage, a remote attacker can trigger a POST request that creates a new user with administrative privileges (is_admin=true). This results in persistent unauthorized access to the dashboard and its sensitive performance data. As of the advisory date, the project has not yet released a patch.
Affected products
- flask-dashboard Flask-MonitoringDashboard up to 5.0.2
Timeline
- 2026-06-07: disclosed: Issue reported to the project maintainers via GitHub issue #557
- 2026-07-08: advisory: CVE published by VulDB/NVD