Improper Access Control in Open-WebUI Affects Admin Details Visibility
CVE-2024-7046
4.3MEDIUM
What is CVE-2024-7046?
An improper access control issue in Open-WebUI version 0.3.8 enables attackers to bypass authentication checks. The vulnerability allows unauthorized users to access sensitive admin details through the /api/v1/auths/admin/details endpoint, revealing critical information about the application's administrator. This poses a significant risk, as it could lead to further exploitation or compromise of the affected system. Organizations using Open-WebUI should prioritize updating to a patched version to mitigate this threat.
Affected Version(s)
open-webui/open-webui <= unspecified