CVE-2026-5632

HIGH

assafelovic gpt-researcher HTTP REST API Endpoint missing authentication

Title source: cna

Description

A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

[Vdb Entry] https://vuldb.com/vuln/355420

[Signature, Permissions Required] https://vuldb.com/vuln/355420/cti

[Third Party Advisory] https://vuldb.com/submit/785874

[Exploit] https://github.com/assafelovic/gpt-researcher/issues/1695

[Product] https://github.com/assafelovic/gpt-researcher/

Scores

CVSS v3 7.3

EPSS 0.0010

EPSS Percentile 27.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-287 CWE-306

Status published

Products (4)

assafelovic/gpt-researcher 3.4.0

assafelovic/gpt-researcher 3.4.1

assafelovic/gpt-researcher 3.4.2

assafelovic/gpt-researcher 3.4.3

Published Apr 06, 2026

Tracked Since Apr 06, 2026