PT-2025-12177 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-07-18 · CVE-2024-7039

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8

Description The application exhibits improper privilege management. An attacker with administrator privileges can delete other administrators by directly accessing the API endpoint http://0.0.0.0:8080/api/v1/users/{uuid administrator}. This action is restricted within the user interface but is achievable through direct API calls using the uuid administrator variable.

Recommendations open-webui/open-webui version v0.3.8: Restrict access to the API endpoint http://0.0.0.0:8080/api/v1/users/{uuid administrator} to prevent unauthorized administrator deletion. As a temporary workaround, consider disabling the API endpoint until a patch is available.

Exploit

Fix

Improper Privilege Management

Incorrect Authorization

Weakness Enumeration

CWE-269

CWE-863

Related Identifiers

CVE-2024-7039

GHSA-PQWR-PHVV-V49F

Affected Products

Open-Webui

References · 8

• 🔥 https://huntr.com/bounties/27fc8a5a-546e-4cf2-8edb-df42e36518fc · Exploit
• https://osv.dev/vulnerability/GHSA-pqwr-phvv-v49f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7039 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7039 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://t.me/cvenotify/129504 · Telegram Post
• https://twitter.com/CVEnew/status/1902671035037594059 · Twitter Post
• https://twitter.com/CveFindCom/status/1902671455516819516 · Twitter Post