CVE-2024-7040: Open WebUI Improper Access Control Vulnerability
Summary
CVE-2024-7040: Withdrawn Advisory: Open WebUI Access Control. Affects open-webui versions < 0.3.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is a web-based user interface designed for managing chat functionalities within applications. It allows administrators to oversee user interactions and manage chat logs effectively. However, in version v0.3.8, it has been identified that the access control mechanisms are flawed, enabling unauthorized access to sensitive chat data.
Vulnerability Detail
The vulnerability arises from improper access control on the frontend admin page of Open WebUI. Administrators are supposed to view only the chats of non-admin members. However, by manipulating the user_id parameter in the request, an attacker can gain access to the chats of any administrator, including those of other owner accounts. This could lead to unauthorized disclosure of sensitive information, potentially compromising the privacy of admin communications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the admin page to trusted IP addresses or implement additional authentication mechanisms until the package can be updated to a secure version.
Conclusion
In summary, CVE-2024-7040 represents a significant security risk for Open WebUI users due to improper access control. It is crucial to update to a patched version to mitigate this risk and protect sensitive information.
See every vulnerability recorded for open-webui →
FAQ
CVE-2024-7040 is a vulnerability in Open WebUI that allows unauthorized access to administrator chat logs due to improper access control.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized disclosure of sensitive chat information, compromising the privacy of administrator communications.
Yes, updating Open WebUI to a version later than v0.3.8 will patch this vulnerability.
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
