PT-2025-12176 · Unknown · Open-Webui/Open-Webui

Published 2025-03-20 · Updated 2025-07-18 · CVE-2024-7036

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8

Description A vulnerability allows an unauthenticated attacker to sign up with excessively large text in the name field, causing the Admin panel to become unresponsive. This prevents administrators from performing essential user management actions. The issue can also be exploited by authenticated users with low privileges, leading to the same unresponsive state in the Admin panel.

Recommendations For open-webui/open-webui version 0.3.8, consider restricting the length of the name field to prevent excessively large input from causing the Admin panel to become unresponsive. As a temporary workaround, limit user sign-ups or manually monitor and manage user accounts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-7036

GHSA-WCWP-9RCP-JVFG

Affected Products

Open-Webui/Open-Webui

References · 7

• 🔥 https://huntr.com/bounties/ba62d093-ab27-48fa-9c53-0602c8cdc48a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7036 · Security Note
• https://osv.dev/vulnerability/GHSA-wcwp-9rcp-jvfg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7036 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/1902968854437040438 · Twitter Post
• https://t.me/cvenotify/129503 · Telegram Post