CVE-2024-7048: open-webui open-webui/open-webui Incorrect Authorization

Vulnerability summary

CVE-2024-7048 is a medium (CVSS 6.3) Incorrect Authorization vulnerability in open-webui open-webui/open-webui. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-10-2024
   PublishedVulnerability first disclosed.
2. 15-10-2025
   Last modifiedVulnerability information updated.

Description

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity and availability of the RAG models.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.