CVE-2024-7041: open-webui Insecure Direct Object Reference (IDOR) vulnerability
(updated )
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint http://0.0.0.0:3000/api/v1/memories/{id}/update, where the decentralization design is flawed, allowing attackers to edit other users’ memories without proper authorization.
References
- github.com/advisories/GHSA-xcvc-5hgv-phqg
- github.com/open-webui/open-webui/blob/main/backend/apps/webui/routers/memories.py
- github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-1744.yaml
- huntr.com/bounties/6855227f-1237-47b8-8d37-29aad7ddec3a
- nvd.nist.gov/vuln/detail/CVE-2024-7041
- pypi.org/project/open-webui
Code Behaviors & Features
Detect and mitigate CVE-2024-7041 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →