PT-2025-12182 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-7046

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8

Description The issue is related to improper access control, allowing an attacker to view admin details without verifying if the attacker is an administrator. This can be exploited by directly calling the "/api/v1/auths/admin/details" endpoint to retrieve the first admin (owner) details.

Recommendations For open-webui/open-webui version 0.3.8, consider restricting access to the "/api/v1/auths/admin/details" endpoint until a patch is available. As a temporary workaround, ensure that only authorized administrators can access admin details by implementing proper access control mechanisms.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-475

Related Identifiers

CVE-2024-7046

GHSA-GV26-QW3H-8QVP

Affected Products

Open-Webui

References · 6

• 🔥 https://huntr.com/bounties/684185e4-6766-4638-b08a-0de9c2820aee · Exploit
• https://osv.dev/vulnerability/GHSA-gv26-qw3h-8qvp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7046 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/1902968884547993852 · Twitter Post