The vulnerability CVE-2026-5632 affects the assafelovic gpt-researcher product up to version 3.4.3. It is caused by missing authentication controls on an HTTP REST API endpoint, enabling remote unauthenticated access to certain functions. The exact impacted API function is unspecified. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The issue was responsibly disclosed but remains unpatched as of the latest information.

An attacker can remotely exploit this vulnerability to access functionality of the gpt-researcher HTTP REST API without authentication. This could lead to unauthorized actions depending on the API's capabilities. The impact is rated medium severity with limited confidentiality, integrity, and availability impact. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider restricting network access to the affected API endpoints and monitor for unusual activity. Avoid exposing the vulnerable versions to untrusted networks until a patch or official mitigation is available.