CVE-2024-7046: Improper Access Control in open-webui/open-webui
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7046?
CVE-2024-7046 is classified as a high severity vulnerability due to its potential impact on system security.
How do I fix CVE-2024-7046?
To fix CVE-2024-7046, upgrade open-webui to a version higher than 0.3.8 where the vulnerability is patched.
What types of attacks can exploit CVE-2024-7046?
CVE-2024-7046 can be exploited through unauthorized API calls to access sensitive admin details.
Which versions of open-webui are affected by CVE-2024-7046?
CVE-2024-7046 affects open-webui version 0.3.8 and earlier.
What are the consequences of an exploit of CVE-2024-7046?
Exploitation of CVE-2024-7046 can lead to unauthorized access to admin details, compromising the integrity and confidentiality of the application.