Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116108openbq-org OpenBB Local API Server api_settings.py access control

Medium 4.3

In plain English

A medium-severity improper access control in OpenBB from openbq-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
openbq-org	OpenBB	4.7.04.7.14.7.25.0

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

References

VDB-426176 | openbq-org OpenBB Local API Server api_settings.py access control vdb-entry
VDB-426176 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-116108 | CVE Analysis and Report third-party-advisory
Submit #1003285 | OpenBB-finance OpenBB 4.7.2 Improper Access Control third-party-advisory