Cyber Resilience

CVE-2024-6866

Flask-Cors Project Flask-Cors 4.0.1

Public PoC
Published
20 March 2025
Modified
03 November 2025
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0066 49th percentile
Risk Priority 58 floored blend · peak EPSS

Summary

CVE-2024-6866 is a high-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Flask-Cors Project Flask-Cors. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-6866 is a vulnerability in corydolphin/flask-cors version 4.01, a Python library for handling Cross-Origin Resource Sharing (CORS) in Flask applications. The issue arises from case-insensitive request path matching implemented via the `try_match` function, which is intended for host matching rather than paths. URL paths are inherently case-sensitive, but the regex matching treats them as case-insensitive, creating a mismatch that permits unauthorized origins to bypass intended restrictions on specific paths.

Attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). Exploitation enables unauthorized origins to access paths configured to be restricted, leading to high confidentiality impacts (C:H) such as data exposure and leaks, without affecting integrity or availability (I:N/A:N). The CVSS v3.1 base score is 7.5, linked to CWE-178 (Improper Handling of Case Sensitivity).

Advisories and patches are detailed in references including a Huntr bounty report at https://huntr.com/bounties/808c11af-faee-43a8-824b-b5ab4f62b9e6 and a Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html. The vulnerability was published on 2025-03-20.

EU & UK References

Vulnerability Data

corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but…

more

the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-6839Same product: Flask-Cors Project Flask-Cors
CVE-2024-6844Same product: Flask-Cors Project Flask-Cors
CVE-2024-38829Shared CWE-178
CVE-2026-33691Shared CWE-178
CVE-2025-27636Shared CWE-178
CVE-2024-5699Shared CWE-178
CVE-2026-29054Shared CWE-178
CVE-2026-8404Shared CWE-178
CVE-2026-48595Shared CWE-178
CVE-2026-15617Shared CWE-178

Affected Assets

flask-cors project
flask-cors
4.0.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Applying access control decisions to each request depends on accurate property determination that accounts for case differences.

Correct enforcement of authorizations for resource access structurally requires consistent case-sensitive handling of identifiers to avoid incorrect decisions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure SDLC practices should include case-sensitivity requirements in design and coding standards.

prevents

Application security requirements must specify case handling for identifiers and paths.

prevents

Architecture principles should enforce canonical, case-aware resource naming.

prevents

Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.

degrades

Access-control rules that ignore case can allow unintended resource access.

degrades

Authentication logic must treat identifiers consistently to avoid bypass via case differences.

References