CVE-2024-7806— Remote Code Execution by Non-Admin Users via CSRF in open-webui/open-webui
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-7806
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote Code Execution by Non-Admin Users via CSRF in open-webui/open-webui
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim's privileges.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Open WebUI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open WebUI是Open WebUI开源的一个可扩展、功能丰富、用户友好的自托管 WebUI。 Open WebUI 0.3.8及之前版本存在安全漏洞，该漏洞源于跨站请求伪造，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui/open-webui | unspecified ~ latest | - |
II. Public POCs for CVE-2024-7806
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-7806
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-7806 (1)
Same Patch Batch · open-webui · 2025-03-20 · 15 CVEs total
| CVE-2024-12534 | Denial of Service (DoS) in open-webui/open-webui | |
| CVE-2024-12537 | Unauthenticated Denial of Service in open-webui/open-webui | |
| CVE-2024-7045 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7044 | Stored XSS in open-webui/open-webui | |
| CVE-2024-7036 | Denial of Service in open-webui/open-webui | |
| CVE-2024-7046 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7053 | Session Fixation in open-webui/open-webui | |
| CVE-2024-7035 | Cross-Site Request Forgery (CSRF) in open-webui/open-webui | |
| CVE-2024-7983 | Denial of Service in open-webui/open-webui | |
| CVE-2024-7043 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7990 | Stored Cross-Site Scripting in open-webui/open-webui | |
| CVE-2024-8060 | Remote Code Execution in OpenWebUI via Arbitrary File Upload | |
| CVE-2024-8017 | Cross-site Scripting (XSS) in open-webui/open-webui | |
| CVE-2024-8053 | Improper Authentication in open-webui/open-webui |
IV. Related Vulnerabilities
Same product: open-webui/open-webui
- CVE-2024-8017
Cross-site Scripting (XSS) in open-webui/open-webui - CVE-2024-7053
Session Fixation in open-webui/open-webui - CVE-2024-8053
Improper Authentication in open-webui/open-webui - CVE-2024-12534
Denial of Service (DoS) in open-webui/open-webui - CVE-2024-7043
Improper Access Control in open-webui/open-webui
Same vendor: open-webui
- CVE-2026-56398
Open WebUI - Stored Cross-Site Scripting via OAuth Picture C - CVE-2026-56400
open-webui - Remote Code Execution via CORS Misconfiguration - CVE-2026-59221
open-webui terminal proxy path traversal guard bypass via 9x - CVE-2026-59225
Open WebUI: Arena task endpoints can bypass underlying model - CVE-2026-59224
Open WebUI: Terminal proxy forwards a spoofable, integrity-u
Same weakness: CWE-352
- CVE-2026-15988
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege - CVE-2025-14469
Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modi - CVE-2025-67651
CSRF in PHP Jabbers scripts - CVE-2026-66416
Leantime CSRF Protection Globally Disabled by Omission of La - CVE-2026-28813
Apache JSPWiki: JSPWiki vulnerable to JSON hijacking
V. Comments for CVE-2024-7806
No comments yet