OpenBB CVE-2026-116108

The weakness is an improper access control (CWE-284) in openbb_platform/core/openbb_core/app/model/api_settings.py within the Local API Server component of OpenBB (through 4.7.2/5.0.0). Exploitation requires user interaction (UI:P) - consistent with luring a user whose machine is running the Local API Server into triggering a browser-based/cross-origin request - and the affected API server component must actually be deployed and running, which is not how every OpenBB user (library/CLI usage) operates. Limiting factors that reduce realistic risk: impact is confined to low confidentiality disclosure (VC:L) with no integrity or availability effect, user interaction is mandatory, and the victim must be running the Local API Server. The precise manipulation that bypasses the access control is not described in the available sources. No vendor-confirmed fixed version is listed; the vendor did not respond to the disclosure.

All available signals converge on low real-world priority. The supplied CVSS 4.0 base score is 2.1 (low), driven by only a low confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N) and a required user-interaction prerequisite (UI:P). The vuln.today decision label is 'monitor', which is consistent with that low score and argues against emergency action. KEV status is not present, so there is no confirmed active exploitation; EPSS is not provided in the input, so exploitation probability cannot be quantified. VulDB's description states an exploit has been published and the vector carries E:P (proof-of-concept), so a public PoC is claimed, but the only references are VulDB entries (vuln page, CTI, CVE page, submission) - none is verified working exploit code. Note one tension to verify: the description calls the affected code the 'Local API Server' yet asserts remote exploitation is possible (AV:N) and requires user interaction (UI:P), which is most consistent with a browser-mediated cross-origin attack against a locally-bound service rather than direct remote access - confirm the deployment/binding model with the vendor. Overall this is a high-visibility-but-low-impact issue, not an urgent patch priority, though note the vendor was unresponsive so no official fix is confirmed.

A user is running OpenBB's Local API Server and is lured to a malicious web page; that page issues cross-origin requests that bypass the improper access controls in api_settings.py to read limited settings/configuration data (low confidentiality impact only). A public proof-of-concept is claimed published by VulDB, though it is not independently verified as working exploit code, and user interaction (UI:P) is required.