GHSA-PQWR-PHVV-V49F Open WebUI Allows Admin Deletion via API Endpoint

In open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability. The application allows an attacker, acting as an admin, to delete other administrators via the API endpoint http://0.0.0.0:8080/api/v1/users/uuidadministrator. This action is restricted by the user...

Open WebUI Allows Admin Deletion via API Endpoint

In open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability. The application allows an attacker, acting as an admin, to delete other administrators via the API endpoint http://0.0.0.0:8080/api/v1/users/uuidadministrator. This action is restricted by the user...

CVE-2024-9431

In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover...

CVE-2024-7039

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-10273

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to...

CVE-2024-10273

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to...

CVE-2024-7039

Open WebUI (open-webui/open-webui) version v0.3.8 contains an improper privilege management vulnerability: an attacker with admin rights can delete other administrators via the API endpoint DELETE http://0.0.0.0:8080/api/v1/users/{uuid_administrator}, bypassing UI restrictions. The issue is confi...

CVE-2024-7039 Improper Privilege Management in open-webui/open-webui

In open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability. The application allows an attacker, acting as an admin, to delete other administrators via the API endpoint http://0.0.0.0:8080/api/v1/users/uuidadministrator. This action is restricted by the user...

CVE-2024-7039

...

CVE-2024-7039

...

CVE-2024-9431 Improper Privilege Management in transformeroptimus/superagi

In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover...

CVE-2024-9431 Improper Privilege Management in transformeroptimus/superagi

In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover...

CVE-2024-9431 Improper Privilege Management in transformeroptimus/superagi

In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover...

CVE-2024-9431

CVE-2024-9431 affects transformeroptimus/superagi v0.0.14. The vulnerability is improper privilege management that allows, after login, a user to change other users’ passwords, enabling potential account takeover. Public sources (NVD/ RH Red Hat/ OSV) rate impact as high (C:H/I:H/A:H; ATT&CK not ...

CVE-2024-10273 Improper Privilege Management in lunary-ai/lunary

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to...

CVE-2024-10273

CVE-2024-10273 affects lunary-ai/lunary v1.5.0. The vulnerability stems from improper privilege management in the models.ts file, where the PATCH endpoint lacks sufficient privilege checks, allowing users with a viewer role to modify models owned by others. The impact is unauthorized changes to c...

CVE-2024-10273 Improper Privilege Management in lunary-ai/lunary

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to...

Lunary 安全漏洞

lunary is lunary open source a production toolkit for LLM . lunary has an authorization problem vulnerability , the vulnerability stems from improper management of PATCH endpoint privileges , an attacker can use this vulnerability to cause low-privilege users to modify others' models...

PT-2025-12177

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8 Description The application exhibits improper privilege management. An attacker with administrator privileges can delete other administrators by directly accessing the API endpoint...

PT-2025-12034 · Unknown · Lunary-Ai/Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.5.0 Description: The issue is related to improper privilege management in the models.ts file, which allows users with viewer roles to modify models owned by others. The "PATCH" endpoint for models lacks appropriate...