CVE-2024-7049

Published: Oct 10, 2024Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.

Affected (1)

Products: Openwebui: Open Webui

Openwebui

1 product

Open Webui

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openwebui Open Webui	Version 0.3.8

Related CWEs

CWE-488

Exposure of Data Element to Wrong Session

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

References (1)

https://huntr.com/bounties/ee9e3532-8ef1-4599-bb59-b8e2ba43a1fc

Source: security@huntr.dev

ExploitThird Party Advisory

Timeline

No history available yet.