Improper Access Control in open-webui Affects User Data Retrieval
CVE-2024-7045

4.3MEDIUM

Key Information:

Vendor

Open-webui

Status
Open-webui/open-webui
Vendor
CVE Published:
20 March 2025

What is CVE-2024-7045?

The open-webui v0.3.8 version is susceptible to improper access control vulnerabilities that allow unauthorized users to access sensitive information. Attackers can exploit this flaw by bypassing the administrator verification process, directly invoking the /api/v1/prompts/ interface to view all admin-created prompt records. This includes critical ID values that can be leveraged to further exploit the system through the /api/v1/prompts/command/{command_id} endpoint, leading to unauthorized retrieval of arbitrary prompt data.

Affected Version(s)

open-webui/open-webui <= unspecified

References

https://huntr.com/bounties/03ea0826-af7b-4717-b63e-90fd19...

CVSS V3.0

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.