CVE-2024-7046: Open WebUI Allows Viewing of Admin Details

March 20, 2025 (updated March 21, 2025)

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.

References

github.com/advisories/GHSA-gv26-qw3h-8qvp
github.com/open-webui/open-webui
huntr.com/bounties/684185e4-6766-4638-b08a-0de9c2820aee
nvd.nist.gov/vuln/detail/CVE-2024-7046

Code Behaviors & Features

Detect and mitigate CVE-2024-7046 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →