CVE-2026-7142

MEDIUM

Wooey API Endpoint scripts.py add_or_update_script improper authorization

Title source: cna
STIX 2.1

Description

A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.13.3rc1 and 0.14.0 is sufficient to resolve this issue. This patch is called f7846fc0c323da8325422cab32623491757f1b88. The affected component should be upgraded.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-359741 | Wooey API Endpoint scripts.py add_or_update_script improper authorization
https://vuldb.com/vuln/359741
Signature, Permissions Required signature permissions-required
VDB-359741 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/359741/cti
Third Party Advisory third-party-advisory
Submit #801533 | wooey Wooey 0.13.3-dev Code Injection
https://vuldb.com/submit/801533
Exploit exploit issue-tracking
https://github.com/wooey/Wooey/issues/408
Patch issue-tracking patch
https://github.com/wooey/Wooey/pull/407

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 11.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-266 CWE-285
Status published
Products (6)
None/Wooey 0.13.0
None/Wooey 0.13.1
None/Wooey 0.13.2
None/Wooey 0.13.3rc1
None/Wooey 0.14.0
pypi/wooey 0 - 0.13.3rc1PyPI
Published Apr 27, 2026
Tracked Since Apr 27, 2026