CVE-2024-7039— Improper Privilege Management in open-webui/open-webui
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-7039
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Privilege Management in open-webui/open-webui
Source: NVD (National Vulnerability Database)
Vulnerability Description
In open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability. The application allows an attacker, acting as an admin, to delete other administrators via the API endpoint `http://0.0.0.0:8080/api/v1/users/{uuid_administrator}`. This action is restricted by the user interface but can be performed through direct API calls.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
Open WebUI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open WebUI是Open WebUI开源的一个可扩展、功能丰富、用户友好的自托管 WebUI。 Open WebUI v0.3.8版本存在安全漏洞，该漏洞源于权限管理不当，允许管理员通过API删除其他管理员。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui/open-webui | unspecified ~ latest | - |
II. Public POCs for CVE-2024-7039
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-7039
请登录查看更多情报信息。
Same Patch Batch · open-webui · 2025-03-20 · 20 CVEs total
| CVE-2024-7046 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-8053 | Improper Authentication in open-webui/open-webui | |
| CVE-2024-8017 | Cross-site Scripting (XSS) in open-webui/open-webui | |
| CVE-2024-8060 | Remote Code Execution in OpenWebUI via Arbitrary File Upload | |
| CVE-2024-7990 | Stored Cross-Site Scripting in open-webui/open-webui | |
| CVE-2024-7043 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7983 | Denial of Service in open-webui/open-webui | |
| CVE-2024-7035 | Cross-Site Request Forgery (CSRF) in open-webui/open-webui | |
| CVE-2024-7053 | Session Fixation in open-webui/open-webui | |
| CVE-2024-7806 | Remote Code Execution by Non-Admin Users via CSRF in open-webui/open-webui | |
| CVE-2024-12534 | Denial of Service (DoS) in open-webui/open-webui | |
| CVE-2024-7033 | Arbitrary File Write in open-webui/open-webui | |
| CVE-2024-7036 | Denial of Service in open-webui/open-webui | |
| CVE-2024-7044 | Stored XSS in open-webui/open-webui | |
| CVE-2024-7040 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7045 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7959 | SSRF in open-webui/open-webui | |
| CVE-2024-7034 | Remote Code Execution due to Arbitrary File Write in open-webui/open-webui | |
| CVE-2024-12537 | Unauthenticated Denial of Service in open-webui/open-webui |
IV. Related Vulnerabilities
Same product: open-webui/open-webui
- CVE-2024-8017
Cross-site Scripting (XSS) in open-webui/open-webui - CVE-2024-7053
Session Fixation in open-webui/open-webui - CVE-2024-8053
Improper Authentication in open-webui/open-webui - CVE-2024-7806
Remote Code Execution by Non-Admin Users via CSRF in open-we - CVE-2024-12534
Denial of Service (DoS) in open-webui/open-webui
Same vendor: open-webui
- CVE-2026-34225
Open WebUI has Blind Server Side Request Forgery in its Imag - CVE-2026-34222
Open WebUI has Broken Access Control in Tool Valves - CVE-2026-29071
Open WebUI's Insecure Direct Object Reference (IDOR) allows - CVE-2026-29070
Open WebUI has unauthorized deletion of knowledge files - CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownershi
Same weakness: CWE-863
- CVE-2026-42571
Privilege Escalation Attack affecting Pelican Web UI - CVE-2025-15633
HCL BigFix WebUI is affected by an improper authorization vu - CVE-2026-42296
Argo Workflows has incomplete fix for CVE-2026-31892: hostNe - CVE-2025-66170
Apache CloudStack: Any user can list backups that they shoul - CVE-2026-41903
FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifyi
V. Comments for CVE-2024-7039
No comments yet