Flask-CORS versions prior to 6.0.0 have a vulnerability where request path matching is incorrectly handled in a case-insensitive manner. This occurs because the `try_match` function, designed for host matching, is used for path matching, which should be case-sensitive. This flaw can allow unauthorized origins to access restricted paths, potentially exposing sensitive data. The issue is fixed in version 6.0.0.