Improper Access Controls in OpenBB Local API Server by openbq-org
CVE-2026-116108

5.3MEDIUM

Key Information:

Vendor

Openbq-org

Status
Openbb
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116108?

A vulnerability exists in OpenBB Local API Server related to improper access controls in the file api_settings.py. This flaw allows for remote exploitation, potentially leading to unauthorized access to sensitive functionalities of the application. Despite early notifications to the vendor regarding this issue, no response was received, raising concerns about the protection of users relying on this software.

Affected Version(s)

OpenBB 4.7.0

OpenBB 4.7.1

OpenBB 4.7.2

References

https://vuldb.com/vuln/426176
vdb-entry
https://vuldb.com/vuln/426176/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116108
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

scription (VulDB User)
VulDB CNA Team
.