CVE-2024-7039: Open WebUI Improper Privilege Management Allows Admin Deletion via API
Summary
CVE-2024-7039: Open WebUI Allows Admin Deletion via API Endpoint. Affects open-webui versions < 0.3.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is a web-based user interface designed for managing various applications and services. It provides a streamlined way for administrators to oversee user accounts, permissions, and system settings. The package is widely used for its ease of use and flexibility. However, it has been identified with a critical vulnerability that allows unauthorized actions through its API, specifically enabling an admin to delete other administrators.
Vulnerability Detail
In open-webui version v0.3.8, there exists an improper privilege management vulnerability. This flaw allows an attacker, masquerading as an admin, to delete other administrator accounts via a direct API call to the endpoint http://0.0.0.0:8080/api/v1/users/{uuid_administrator}. Although the user interface restricts this action, the API does not enforce the same restrictions, leading to potential abuse. The ramifications of this vulnerability are severe, as it could lead to loss of administrative control and compromise the security of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the API endpoint by implementing additional authentication checks or by disabling the API access for users who do not require it. This can be done by modifying your server configuration to limit access based on user roles.
Conclusion
The vulnerability identified as CVE-2024-7039 in Open WebUI poses a significant risk due to improper privilege management, allowing unauthorized deletion of administrator accounts. It is crucial for users of this package to update to a patched version to mitigate the risk and ensure the security of their applications.
See every vulnerability recorded for open-webui →
FAQ
CVE-2024-7039 is a vulnerability in the Open WebUI package that allows an admin to delete other administrators via an unsecured API endpoint.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to test your application without needing to sign up.
The CVSS score of this vulnerability is 8.3, indicating a high level of severity.
If an immediate update is not possible, implement a workaround by restricting API access or adding additional authentication checks.
More information about Open WebUI can be found on its official repository or documentation site, where you can learn about its features and usage.
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
