Improper Access Control in Open-WebUI Affects Admin Details Visibility

CVE-2024-7046

What is CVE-2024-7046?

An improper access control issue in Open-WebUI version 0.3.8 enables attackers to bypass authentication checks. The vulnerability allows unauthorized users to access sensitive admin details through the /api/v1/auths/admin/details endpoint, revealing critical information about the application's administrator. This poses a significant risk, as it could lead to further exploitation or compromise of the affected system. Organizations using Open-WebUI should prioritize updating to a patched version to mitigate this threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References