Improper Access Control in open-webui Affects User Data Retrieval

CVE-2024-7045

What is CVE-2024-7045?

The open-webui v0.3.8 version is susceptible to improper access control vulnerabilities that allow unauthorized users to access sensitive information. Attackers can exploit this flaw by bypassing the administrator verification process, directly invoking the /api/v1/prompts/ interface to view all admin-created prompt records. This includes critical ID values that can be leveraged to further exploit the system through the /api/v1/prompts/command/{command_id} endpoint, leading to unauthorized retrieval of arbitrary prompt data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References