Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Open WebUI

CVE-2024-7046: Open WebUI Allows Viewing of Admin Details

mediumCVSS 3.0 4.3GHSA-gv26-qw3h-8qvp

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.

Published Mar 20, 2025 · Updated Oct 15, 2025

Affected packages

open-webui

Ecosystem
PyPI
Affected
<= 0.3.8
Fixed in
No patched version yet
Check
pip show open-webui

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Open WebUI vulnerabilities

All Open WebUI entries