CVE-2024-7039: Open WebUI Admin Deletion Vulnerability via API Endpoint
Summary
CVE-2024-7039: Open WebUI Allows Admin Deletion via API Endpoint. Affects open-webui versions < 0.3.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is a web-based user interface designed for managing various applications and services. It provides administrators with tools to manage users, settings, and configurations efficiently. However, in version v0.3.8, it has been found to have a critical vulnerability that allows an admin to delete other administrators through an unsecured API endpoint, undermining the integrity of user management.
Vulnerability Detail
In open-webui version v0.3.8, there exists an improper privilege management vulnerability. The application permits an attacker, impersonating an admin, to delete other administrators via the API endpoint 'http://0.0.0.0:8080/api/v1/users/{uuid_administrator}'. While this action is restricted in the user interface, it can still be executed through direct API calls, posing a significant risk to the application's security and user management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the API endpoint by implementing additional authentication checks or IP whitelisting to prevent unauthorized API calls until a patch is applied.
Conclusion
The open-webui package version v0.3.8 contains a critical vulnerability that allows admin users to delete other administrators via an insecure API endpoint. It is essential to update to the latest version to secure your application and prevent unauthorized access.
See every vulnerability recorded for open-webui →
FAQ
CVE-2024-7039 is a vulnerability in the open-webui package that allows an admin to delete other administrators via an unsecured API endpoint.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability allows unauthorized deletion of administrator accounts, which can lead to loss of control over the application and potential data breaches.
Yes, a patched version of open-webui is available. Update your package to the latest version to mitigate the risk.
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
