CVE-2026-7142 Details
Description
A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.13.3rc1 and 0.14.0 is sufficient to resolve this issue. This patch is called f7846fc0c323da8325422cab32623491757f1b88. The affected component should be upgraded.
A vulnerability exists in Wooey versions prior to 0.13.2, specifically in the 'add_or_update_script' function within the 'wooey/api/scripts.py' file. This issue arises because the API endpoint only verifies if a user is authenticated, without checking for staff or admin privileges. As a result, any registered user can upload arbitrary Python scripts, which are then executed by Celery workers, leading to remote code execution. The vulnerability can be exploited remotely and has been publicly disclosed.
Users can upgrade to Wooey version 0.13.3rc1 or 0.14.0 to address this vulnerability. The patch has been merged into the main branch and is available for download.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wooey/Wooey/ | [email protected] | ProductVendor |
| https://github.com/wooey/Wooey/commit/f7846fc0c323da8325422cab32623491757f1b88 | [email protected] | Source CodeVendor |
| https://github.com/wooey/Wooey/issues/408 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/wooey/Wooey/pull/407 | [email protected] | Issue TrackingVendor |
| https://github.com/wooey/Wooey/releases/tag/v0.13.3rc1 | [email protected] | Vendor |
| https://vuldb.com/submit/801533 | [email protected] | Technical Description |
| https://vuldb.com/vuln/359741 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/vuln/359741/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wooey | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |