CVE-2024-7040

View on CVE.org
Published Mar 20, 2025 CVSS n/a EPSS n/a KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-6948 In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the user_id parameter, it is possible to view the chats of any administrator, including those of other admin (owner) accounts.
Github GHSA Github GHSA GHSA-cfvq-fj53-j2c7 Withdrawn Advisory: Open WebUI Access Control
References

No reference.

History
Type Values Removed Values Added
Title Improper Access Control in open-webui/open-webui
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the user_id parameter, it is possible to view the chats of any administrator, including those of other admin (owner) accounts. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Weaknesses CWE-639
Type Values Removed Values Added
First Time appeared Openwebui
Openwebui open Webui
CPEs cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*
Vendors & Products Openwebui
Openwebui open Webui
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the user_id parameter, it is possible to view the chats of any administrator, including those of other admin (owner) accounts.
Title Improper Access Control in open-webui/open-webui
Weaknesses CWE-284
References
Metrics cvssV3_0

{'score': 4.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}
Earlier changes (2)
Weaknesses

No weakness.

Sources

Status
REJECTED
Assigner
@huntr_ai
Published
Updated
Jul 16, 2026, 3:37 PM
Reserved
Jul 23, 2024, 5:55 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Mar 20, 2025, 10:15 AM
Modified
Oct 16, 2026, 2:10 PM

View source JSON

No data.

No data.