CVE-2024-7040: In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view…

PriorityP426medium4.9CVSS 3.0

AVNACLPRHUINSUCHINAN

EPSS

0.56%

42.5th percentile

In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the user_id parameter, it is possible to view the chats of any administrator, including those of other admin (owner) accounts.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
open-webui	open-webui_open-webui	unspecified – latest	—
openwebui	open_webui	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.