A flaw in OpenBB’s api_settings.py causes improper access controls, allowing an attacker to perform unauthorized actions on the Local API Server. Remote exploitation is possible, enabling the attacker to access sensitive data or invoke privileged API functions. The vulnerability does not directly provide code execution but can lead to data exposure or unauthorized manipulation of the platform’s internal state.

The issue affects openbq-org’s OpenBB product up through versions 4.7.2 and 5.0.0. It targets an unidentified portion of the file openbb_platform/core/openbb_core/app/model/api_settings.py within the Local API Server component. Systems running these affected releases are therefore at risk if the Local API Server is reachable from external networks.

The CVSS score of 5.3 indicates a medium severity. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog, but an exploit has been published and is reportedly usable. The attack appears to be exploitable remotely, most likely over an open network or via an exposed API endpoint. Because the flaw is caused by improper access control, an attacker only needs network access to the API and no additional local privileges.