TI-2026-06265 Aliases CVE-2026-7142 GHSA-w65c-cmxj-qrhm

Wooey API Endpoint scripts.py add_or_update_script improper authorization

MEDIUM 57CWE-266Published 2026-04-27 · Updated 2026-04-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-266 and CWE-285.

Summary

A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.13.3rc1 and 0.14.0 is sufficient to resolve this issue. This patch is called f7846fc0c323da8325422cab32623491757f1b88. The affected component should be upgraded.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00215 11th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Wooey: 0.13.3rc1, 0.14.0wooey (PyPI): 0.13.3rc1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Wooey	0.13.0; 0.13.1; 0.13.2	0.13.3rc1, 0.14.0	Patch available	CNA
—	wooey (PyPI)	before 0.13.3rc1	0.13.3rc1	Patch available	GHSA-w65c-cmxj-qrhm

Wooey Vendor— Affected 0.13.0; 0.13.1; 0.13.2 Fixed in 0.13.3rc1, 0.14.0 Patch available CNA
wooey (PyPI) Vendor— Affected before 0.13.3rc1 Fixed in 0.13.3rc1 Patch available GHSA-w65c-cmxj-qrhm

Remediation

Fix · CNA Wooey Fixed in 0.13.3rc1, 0.14.0
Fix · GHSA-w65c-cmxj-qrhm wooey (PyPI) Fixed in 0.13.3rc1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-7142
2026-10-03 Alias added: GHSA-w65c-cmxj-qrhm

References

Exploit 1

https://github.com/wooey/Wooey/issues/408

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-7142

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences