CVE-2024-7049

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process...

PT-2024-38044 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui/open-webui version v0.3.8 Description: A vulnerability exists where a token is returned when a user with a pending role logs in, allowing the user to perform actions without admin confirmation and bypassing the intended approval...