Improper Access Control in Open-WebUI Affects Admin Details Visibility

CVE-2024-7046

Summary

An improper access control issue in Open-WebUI version 0.3.8 enables attackers to bypass authentication checks. The vulnerability allows unauthorized users to access sensitive admin details through the /api/v1/auths/admin/details endpoint, revealing critical information about the application's administrator. This poses a significant risk, as it could lead to further exploitation or compromise of the affected system. Organizations using Open-WebUI should prioritize updating to a patched version to mitigate this threat.

References