CVE-2023-4455

Name of the Vulnerable Software and Affected Versions wallabag versions prior to 2.6.3

Description The issue is related to Cross-Site Request Forgery (CSRF) in the wallabag GitHub repository. This allows attackers to arbitrarily delete API keys via the /developer/client/delete/{id} endpoint.

Recommendations For versions prior to 2.6.3, update to version 2.6.3 or higher, especially if you have more than one user and/or have open registration. As a temporary workaround, consider restricting access to the /developer/client/delete/{id} endpoint until the update is applied.