CVE-2024-7039 Information

Description

In open-webui/open-webui version v0.3.8 there is an improper privilege management vulnerability. The application allows an attacker acting as an admin to delete other administrators via the API endpoint http://0.0.0.0:8080/api/v1/users/uuid_administrator. This action is restricted by the user interface but can be performed through direct API calls.

Reference

https://huntr.com/bounties/27fc8a5a-546e-4cf2-8edb-df42e36518fc