Openbb
Monthly
Improper access control in the Local API Server component of OpenBB (openbb_platform/core/openbb_core/app/model/api_settings.py) allows remote attackers to reach API behaviour they should not be able to influence, resulting in limited confidentiality disclosure. The issue affects versions up to and including 4.7.2 and 5.0.0, and exploitation requires the Local API Server to be deployed and running plus user interaction - consistent with luring a user into triggering a browser-based or cross-origin request against the locally running server; library or CLI-only users are not exposed. The disclosure states that exploit code has been published and may be used, but there is no KEV confirmation of active in-the-wild exploitation, EPSS scoring is not available in the supplied data, the impact is confined to low confidentiality with no integrity or availability effect, and the vuln.today decision label is 'monitor'; the vendor was contacted and did not respond.
Improper access control in the Local API Server component of OpenBB (openbb_platform/core/openbb_core/app/model/api_settings.py) allows remote attackers to reach API behaviour they should not be able to influence, resulting in limited confidentiality disclosure. The issue affects versions up to and including 4.7.2 and 5.0.0, and exploitation requires the Local API Server to be deployed and running plus user interaction - consistent with luring a user into triggering a browser-based or cross-origin request against the locally running server; library or CLI-only users are not exposed. The disclosure states that exploit code has been published and may be used, but there is no KEV confirmation of active in-the-wild exploitation, EPSS scoring is not available in the supplied data, the impact is confined to low confidentiality with no integrity or availability effect, and the vuln.today decision label is 'monitor'; the vendor was contacted and did not respond.