CVE-2022-51020 MEDIUM

CVE-2022-51020: Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Vendor Mher

Product flower

Weakness CWE-352 · CSRF

Published October 12, 2026

Last update October 15, 2026

View on NVD All CVEs

CVSS base score

6.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.

Key dates

02Disclosure timeline

October 12, 2026 CVE published

October 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-51020 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities

04Related CVE

CVE-2026-65488 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification CVE-2026-64876 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension CVE-2026-57785 WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-81273 WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability