CVE-2024-7041: open-webui open-webui/open-webui

Vulnerability summary

CVE-2024-7041 is a medium (CVSS 6.5) vulnerability in open-webui open-webui/open-webui. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-10-2024
   PublishedVulnerability first disclosed.
2. 15-10-2025
   Last modifiedVulnerability information updated.

Description

An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.