CVE-2026-7142: Wooey Auth Bypass Vulnerability

CVE-2026-7142 Overview

A vulnerability has been identified in Wooey, a web-based interface for Python scripts, affecting versions up to 0.13.2. The vulnerability exists in the add_or_update_script function within wooey/api/scripts.py of the API Endpoint component. This improper authorization flaw (CWE-266: Incorrect Privilege Assignment) allows authenticated users to perform script upload operations without proper staff-level privilege verification, potentially enabling unauthorized script modifications.

Critical Impact
Authenticated users without staff privileges can upload or modify scripts through the API endpoint, bypassing intended authorization controls. This could allow unauthorized code execution on systems running Wooey.

Affected Products

Wooey versions up to 0.13.2
Wooey API Endpoint (wooey/api/scripts.py)
Systems using the add_or_update_script function without staff authorization checks

Discovery Timeline

2026-04-27 - CVE-2026-7142 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7142

Vulnerability Analysis

This vulnerability represents an improper authorization flaw where the add_or_update_script API endpoint fails to verify that the authenticated user has staff-level privileges before allowing script upload operations. The function only checked for authentication via the @requires_login decorator but did not validate the user's authorization level, allowing any authenticated user to upload or update scripts.

The root cause stems from missing privilege verification in a sensitive administrative function. While the endpoint correctly required users to be logged in, it incorrectly assumed that all authenticated users should have permission to manage scripts—a function typically reserved for administrative staff.

Root Cause

The add_or_update_script function in wooey/api/scripts.py was missing an authorization check to verify that the requesting user has staff-level privileges (is_staff). The existing @requires_login decorator only validated that the user was authenticated, not that they had appropriate permissions for administrative script management operations. This represents a classic broken access control vulnerability where authentication is enforced but authorization is not.

Attack Vector

An attacker with valid non-privileged credentials can exploit this vulnerability remotely by sending a POST request to the add_or_update_script API endpoint. Since the endpoint only verifies authentication status and not authorization level, the attacker can upload malicious scripts or modify existing ones without requiring staff privileges.

The attack requires:

Valid user credentials (any authenticated user)
Network access to the Wooey application
Knowledge of the API endpoint structure

python

 @require_http_methods(["POST"])
 @requires_login
 def add_or_update_script(request):
+    if not request.user.is_staff:
+        return JsonResponse(
+            {
+                "valid": False,
+                "errors": {
+                    "__all__": [
+                        force_str(
+                            _("You do not have permission to upload scripts.")
+                        )
+                    ]
+                },
+            },
+            status=403,
+        )
     submitted_data = request.POST.dict()
     files = request.FILES

Source: GitHub Commit Details

Detection Methods for CVE-2026-7142

Indicators of Compromise

Unexpected POST requests to the script upload API endpoint from non-staff user accounts
Unauthorized script additions or modifications in the Wooey script directory
Audit logs showing script management operations by users without staff privileges
Anomalous script execution patterns or unfamiliar scripts appearing in the Wooey interface

Detection Strategies

Monitor API access logs for POST requests to /api/scripts/ endpoints from non-administrative accounts
Implement application-level logging to track all script upload and modification operations with user attribution
Review Django user session data to correlate script management actions with user privilege levels
Deploy web application firewall rules to flag suspicious API request patterns to administrative endpoints

Monitoring Recommendations

Enable verbose logging for all API endpoint access in Wooey applications
Configure alerts for script upload activities and correlate with user privilege levels
Periodically audit installed scripts against an approved baseline to detect unauthorized additions
Monitor for HTTP 403 responses after patching, which may indicate attempted exploitation

How to Mitigate CVE-2026-7142

Immediate Actions Required

Upgrade Wooey to version 0.13.3rc1 or 0.14.0 immediately to apply the security fix
Review user accounts with access to the Wooey application and audit their privilege levels
Examine recently uploaded or modified scripts for unauthorized changes
Temporarily restrict API endpoint access if immediate patching is not possible

Patch Information

The vulnerability has been addressed in Wooey versions 0.13.3rc1 and 0.14.0. The fix, identified by commit hash f7846fc0c323da8325422cab32623491757f1b88, adds an is_staff authorization check to the add_or_update_script function. Users who are not staff members now receive a 403 Forbidden response with an appropriate error message when attempting to access this endpoint.

For detailed information about the patch, refer to:

Workarounds

Implement network-level access controls to restrict API endpoint access to trusted IP addresses
Add a reverse proxy or web application firewall rule to block POST requests to /api/scripts/ from non-administrative users
Temporarily disable script upload functionality by modifying URL routing until the patch can be applied
Enforce strict user account management, limiting authenticated access to only trusted individuals

bash

# Configuration example
# Upgrade Wooey to patched version
pip install --upgrade wooey>=0.14.0

# Verify installed version
pip show wooey | grep Version

# If using requirements.txt, update the version constraint
# wooey>=0.14.0