CVE-2023-0737: Wallabag

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

Affected products

• Wallabag Wallabag: version 2.5.2 only

Published 2024-11-15. Last modified 2026-06-17.