vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-7142

Wooey API Endpoint scripts.py add_or_update_script improper authorization

MEDIUM
6.3
CVSS Score
Published: April 27, 2026 at 05:00 PM UTC
Updated: June 17, 2026 at 11:01 AM UTC
1 product affected across 1 vendorWooey

Using Wooey by N/A?

Get instant alerts when new vulnerabilities affect Wooey - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.3
Exploit prediction
EPSS 0.2%
SSVC
PoC

Description

A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.13.3rc1 and 0.14.0 is sufficient to resolve this issue. This patch is called f7846fc0c323da8325422cab32623491757f1b88. The affected component should be upgraded.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Wooey· Wooey
60%
0.13.00.13.10.13.2
Vendor states this is fixed in 0.13.3rc1 (unaffected)
Vendor states this is fixed in 0.14.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (8)

VDB EntryTechnical Description
Source: cverecord
https://vuldb.com/vuln/359741
SignaturePermissions Required
Source: cverecord
https://vuldb.com/vuln/359741/cti
Third Party Advisory
Source: cverecord
https://vuldb.com/submit/801533
ExploitIssue Tracking
Source: cverecord
https://github.com/wooey/Wooey/issues/408
Issue TrackingPatch
Source: cverecord
https://github.com/wooey/Wooey/pull/407
Patch
Source: cverecord
https://github.com/wooey/Wooey/commit/f7846fc0c323da8325422cab32623491757f1b88
Patch
Source: cverecord
https://github.com/wooey/Wooey/releases/tag/v0.13.3rc1
Product
Source: cverecord
https://github.com/wooey/Wooey/

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.3MEDIUMVulDB
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-285CWE-266

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card