GitHub Advisoryadvisory · PyPI

GHSA-c7fq-p62p-wvpc Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read

MEDIUM Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-7045
Ecosystem
PyPI
Packages
open-webui
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-1100, CWE-862
Reviewed
2025-03-21

Affected packages

• PyPI open-webui: <= 0.3.8 (no fix yet)

Description

In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information.

Related

Alias · not in database (1)

Weakness · CWE (2)

  • CWE-1100 Insufficient Isolation of System-Dependent Functions weakness
  • CWE-862 Missing Authorization weakness

References