A flaw in Wooey’s add_or_update_script function inside wooey/api/scripts.py allows an attacker to bypass authorization controls when adding or updating scripts. Because the endpoint does not require sufficient privileges, a malicious user can create or modify scripts on the system, potentially leading to privilege escalation or unauthorized execution. The vulnerability is identified as a classic authorization failure (CWE-266 and CWE-285) and can be exploited remotely through the public API.

Wooey, versions up to 0.13.2, including the 0.13.3rc1 release and 0.14.0. Upgrading to 0.13.3rc1 or newer resolves the issue. The affected component is the API Endpoint in the script handling module.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no large‑scale exploitation has been observed. Nevertheless, the flaw can be reached remotely via the API, and the public exploit has been disclosed, so any exposed instance is at risk. Administrators should treat the vulnerability as significant enough to warrant prompt remediation.