Improper Access Control in Open-WebUI Affects Admin Details Visibility
CVE-2024-7046

4.3MEDIUM

Key Information:

Vendor

Open-webui

Status
Open-webui/open-webui
Vendor
CVE Published:
20 March 2025

What is CVE-2024-7046?

An improper access control issue in Open-WebUI version 0.3.8 enables attackers to bypass authentication checks. The vulnerability allows unauthorized users to access sensitive admin details through the /api/v1/auths/admin/details endpoint, revealing critical information about the application's administrator. This poses a significant risk, as it could lead to further exploitation or compromise of the affected system. Organizations using Open-WebUI should prioritize updating to a patched version to mitigate this threat.

Affected Version(s)

open-webui/open-webui <= unspecified

References

https://huntr.com/bounties/684185e4-6766-4638-b08a-0de9c2...

CVSS V3.0

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.