Medium severity6.5NVD Advisory· Published Nov 15, 2024· Updated Jun 17, 2026

CVE-2023-0737

Description

wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
wallabag/wallabagPackagist	< 2.5.4	2.5.4

Affected products

ghsa-coords
pkg:composer/wallabag/wallabag
Range: < 2.5.4
Walla Telesite/Wallabag/wallabagv5
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/wallabag/wallabag/commit/268372dbbdd7ef87b84617fdebf95d0a86caf7dcnvdPatchWEB
huntr.com/bounties/4ba20fe7-4061-4dfb-ab2f-ecaf110641a5nvdExploitWEB
github.com/advisories/GHSA-99w8-c5f6-96ppghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-0737ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000