1521 matches found
CVE-2024-7040 Improper Access Control in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the userid parameter, it is possible to view the chats of any administrator,...
CVE-2024-7040
Open WebUI (open-webui/open-webui) v0.3.8 contains an improper access control vulnerability on the frontend admin page. An administrator can view chats of other administrators by altering the user_id parameter, exposing admin chat logs. The issue is documented in Red Hat’s CVE entry and mirrored ...
CVE-2024-7046
CVE-2024-7046 affects open-webui/open-webui v0.3.8. It is an improper access-control vulnerability that allows an attacker to view the first admin (owner) details by directly calling /api/v1/auths/admin/details without verifying admin privileges. The issue is demonstrated by public PoCs (e.g., a ...
CVE-2024-7046 Improper Access Control in open-webui/open-webui
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin...
CVE-2024-7046 Improper Access Control in open-webui/open-webui
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin...
CVE-2024-7046 Improper Access Control in open-webui/open-webui
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin...
CVE-2024-7999
CVE-2024-7999 is rejected/not used; refer to CVE-2024-53981.
CVE-2024-12537 Unauthenticated Denial of Service in open-webui/open-webui
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely...
CVE-2024-12537 Unauthenticated Denial of Service in open-webui/open-webui
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely...
CVE-2024-12537 Unauthenticated Denial of Service in open-webui/open-webui
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely...
CVE-2024-9840
CVE-2024-9840 is a duplicate of CVE-2024-53981 (per the initial description). Connected data confirms CVE-2024-53981 describes a vulnerability in python-multipart (a streaming multipart parser) with a DoS risk when parsing form data; fixed in version 0.0.18. There is no separate active entry for ...
CVE-2024-7959
The Open WebUI SSRF issue is in open-webui/open-webui version 0.3.8, exposed via the /openai/models endpoint. The vulnerable component allows changing the OpenAI URL without validation, causing the server to issue requests to arbitrary destinations and return their output. Reported impact include...