CVE-2024-7049 MEDIUM

CVE-2024-7049: Exposure of Token in open-webui/open-webui

Vendor Open-Webui
Product open-webui/open-webui
Weakness CWE-488
Published October 10, 2024
Last update October 10, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.

Key dates

02Disclosure timeline

October 10, 2024 CVE published
October 10, 2024 Record updated