CVE-2024-7039

🗓️ 20 Mar 2025 10:11:02Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 66 Views🌐 WEB

Improper privilege management in open-webui v0.3.8 allows API deletion of administrators.

Reporter	Title	Published	Views	Family All 11
CNNVD	Open WebUI 安全漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-7039 Improper Privilege Management in open-webui/open-webui	20 Mar 202510:11	–	cvelist
EUVD	EUVD-2025-6961	3 Oct 202520:07	–	euvd
Github Security Blog	Open WebUI Allows Admin Deletion via API Endpoint	20 Mar 202512:32	–	github
NVD	CVE-2024-7039	20 Mar 202510:15	–	nvd
OSV	GHSA-PQWR-PHVV-V49F Open WebUI Allows Admin Deletion via API Endpoint	20 Mar 202512:32	–	osv
Positive Technologies	PT-2025-12177 · Unknown · Open-Webui	20 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-7039	22 Mar 202512:37	–	redhatcve
Snyk	Improper Privilege Management	20 Mar 202512:32	–	snyk
vulnersOsv	openwebui-token-tracking (=0.1.7) potentially affected by CVE-2024-7039 via open-webui (=0.6.0)	20 Mar 202512:32	–	vulnersosv

NVD

Node

openwebui open_webuiMatch0.3.8

[
  {
    "vendor": "open-webui",
    "product": "open-webui/open-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/27fc8a5a-546e-4cf2-8edb-df42e36518fc

Parameter	Position	Path	Description	CWE
uuid_administrator	path	/api/v1/users/{uuid_administrator}	Improper privilege management allows an admin to delete other administrators via API.	CWE-269, CWE-863

15 Oct 2025 13:15Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16.7

CVSS 38.3

EPSS0.00165

SSVC