Impact

Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints.

Patches

Upgrade to Flask-AppBuilder 3.3.4

Workarounds

References

For more information

If you have any questions or comments about this advisory:

• Open an issue in https://github.com/dpgaspar/Flask-AppBuilder