EUVD-2026-25893Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires only a valid user account (PR:L); no complexity or interaction needed; limited C/I/A reflects partial script management access without confirmed full system takeover.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.13.3rc1 and 0.14.0 is sufficient to resolve this issue. This patch is called f7846fc0c323da8325422cab32623491757f1b88. The affected component should be upgraded.
AnalysisAI
Improper authorization in Wooey versions up to 0.13.2 permits any authenticated non-staff user to upload or update Python scripts via the add_or_update_script API endpoint in wooey/api/scripts.py, bypassing the intended staff-only privilege boundary. Because Wooey executes uploaded scripts on the underlying server, this flaw carries escalation potential beyond the limited CVSS 4.0 base score of 2.1 in multi-tenant or internet-facing deployments. A proof-of-concept has been publicly disclosed; the vulnerability is not in CISA KEV, and EPSS is negligible at 0.04% (13th percentile), suggesting exploitation remains opportunistic rather than widespread.
Technical ContextAI
Wooey is an open-source Django web application that wraps Python command-line scripts in a browser-based graphical interface, enabling non-technical users to run and manage scripts. The vulnerable function add_or_update_script in wooey/api/scripts.py handles REST API requests to register or modify scripts within the platform. The root cause is CWE-266 (Incorrect Privilege Assignment): the endpoint processed script upload requests for any authenticated user without verifying staff-level privileges via Django's request.user.is_staff attribute. The authentication layer correctly identified the user, but the authorization layer failed to enforce the intended role boundary. The fix at commit f7846fc0c323da8325422cab32623491757f1b88 inserts an explicit is_staff guard that returns HTTP 403 with a permission-denied message for non-staff accounts. Affected versions confirmed by EUVD-2026-25893 are 0.13.0, 0.13.1, and 0.13.2, hosted at https://github.com/wooey/Wooey/.
RemediationAI
Upgrade to Wooey 0.13.3rc1 or 0.14.0, both of which include the authorization fix introduced in commit f7846fc0c323da8325422cab32623491757f1b88 (https://github.com/wooey/Wooey/commit/f7846fc0c323da8325422cab32623491757f1b88). The 0.13.3rc1 release tag is available at https://github.com/wooey/Wooey/releases/tag/v0.13.3rc1. If immediate upgrade is not feasible, restrict access to the script upload API endpoint at the reverse proxy or WAF layer to only staff-designated IP ranges, accepting the trade-off of operational friction for legitimate remote staff. Alternatively, temporarily disable or block the add_or_update_script API route entirely if active script management is not required in production. No significant side effects are expected from applying the patch, as it enforces the pre-existing intended privilege model.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today