Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a fix. If immediate upgrade is not possible, manually disable password reset routes in the application configuration; implement additional access controls at the web server or proxy level to block access to the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is
    configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint
    remains registered and accessible, despite not being displayed in the user interface. This allows an
    enabled user to reset their password and be able to create JWT tokens even after the user is disabled on
    the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a
    fix. If immediate upgrade is not possible, manually disable password reset routes in the application
    configuration; implement additional access controls at the web server or proxy level to block access to
    the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.
    (CVE-2025-58065)

ID	Name	Product	Family	Type	Severity
457603	Echo: flask-appbuilder: security update to 4.8.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457603	Echo: flask-appbuilder: security update to 4.8.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
435272	SCA: security update for flask-appbuilder (GHSA-765j-9r45-w2q2)	Tenable Cloud Security	SCA Checks	Local	medium
435272	SCA: security update for flask-appbuilder (GHSA-765j-9r45-w2q2)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-58065

medium

Tenable Plugins

medium

medium

medium

medium