PT-2025-12178 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-07-18 · CVE-2024-7040

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8

Description The issue is related to improper access control. Administrators are supposed to view only the chats of non-admin members on the frontend admin page. However, it is possible to view the chats of any administrator by modifying the user id parameter. This allows access to the chats of other admin, including owner accounts.

Recommendations For version v0.3.8, as a temporary workaround, consider restricting access to the user id parameter in the affected API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2024-7040

Affected Products

Open-Webui

References · 5

• 🔥 https://huntr.com/bounties/bd182309-4aa4-4747-941e-bbc1741955c1 · Exploit
• https://osv.dev/vulnerability/CVE-2024-7040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7040 · Security Note
• https://t.me/cvenotify/129505 · Telegram Post
• https://twitter.com/CVEnew/status/1902968875211427926 · Twitter Post