PT-2024-38043 · Unknown · Open-Webui

Published 2024-10-09 · Updated 2025-07-29 · CVE-2024-7048

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions open-webui version v0.3.8

Description The issue is related to improper privilege management in the API endpoints "GET /api/v1/documents/" and "POST /rag/api/v1/doc". This allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin, compromising the integrity and availability of the RAG models. An attacker can exploit this to view metadata of files uploaded by an admin and overwrite these files.

Recommendations For open-webui version v0.3.8, patch immediately and review access controls to mitigate the risk of unauthorized access. As a temporary workaround, consider restricting access to the API endpoints "GET /api/v1/documents/" and "POST /rag/api/v1/doc" until a patch is available.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2024-7048

Affected Products

Open-Webui

References · 8

• 🔥 https://huntr.com/bounties/acd0b2dd-61eb-4712-82d3-a4e35d6ee560 · Exploit
• https://osv.dev/vulnerability/CVE-2024-7048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7048 · Security Note
• https://twitter.com/CVEnew/status/1844204400861917543 · Twitter Post
• https://t.me/cvedetector/7542 · Telegram Post
• https://t.me/cvenotify/97710 · Telegram Post
• https://twitter.com/oktsec/status/1844266070703477103 · Twitter Post
• https://t.me/cveNotify/130135 · Telegram Post