CVE-2024-7039
Improper Privilege Management in open-webui/open-webui
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Improper Privilege Management in open-webui/open-webui
In open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability. The application allows an attacker, acting as an admin, to delete other administrators via the API endpoint `http://0.0.0.0:8080/api/v1/users/{uuid_administrator}`. This action is restricted by the user interface but can be performed through direct API calls.
Reserved 2024-07-23 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-269 Improper Privilege Management
huntr.com/bounties/27fc8a5a-546e-4cf2-8edb-df42e36518fc
Support options
