CVE-2024-7048

🗓️ 10 Oct 2024 01:22:16Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 118 Views🌐 WEB

In v0.3.8 of open-webui, improper privilege management vulnerability allows lower-privileged user to access and overwrite higher-privileged admin files compromising RAG models' integrity and availability

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-7048	10 Oct 202405:02	–	circl
CNNVD	Open WebUI security vulnerabilities	10 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-7048 IDOR in open-webui/open-webui	10 Oct 202401:22	–	cvelist
EUVD	EUVD-2024-48049	3 Oct 202520:07	–	euvd
Mend	CVE-2024-7048	10 Oct 202401:22	–	mend
NVD	CVE-2024-7048	10 Oct 202402:15	–	nvd
Positive Technologies	PT-2024-38043 · Unknown · Open-Webui	9 Oct 202400:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-7048: Incorrect Authorization	10 Oct 202400:00	–	rapid7
RedhatCVE	CVE-2024-7048	23 May 202510:41	–	redhatcve
Snyk	Improper Privilege Management	10 Oct 202401:43	–	snyk

NVD

Vulnrichment

Node

openwebui open_webuiMatch0.3.8

[
  {
    "vendor": "open-webui",
    "product": "open-webui/open-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/acd0b2dd-61eb-4712-82d3-a4e35d6ee560

Parameter	Position	Path	Description	CWE
GET	path	/api/v1/documents/	Improper privilege management allows a lower-privileged user to access metadata of files uploaded by a higher-privileged admin.	CWE-863
POST	path	/rag/api/v1/doc	Improper privilege management allows a lower-privileged user to overwrite files managed by a higher-privileged admin.	CWE-863

17 Jun 2026 08:19Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.15.4

CVSS 36.3

EPSS0.00372

SSVC

CWE-863