CVE-2024-7045
Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read
CVE-2024-7045 has been rejected by its source and should not be treated as a live vulnerability, published March 20, 2025.
- Severity
- 4.3 MediumCVSS 3.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
open-webuiPyPI | through 0.3.8 | None known |
open-webuiPyPI | through 0.3.8, plus listed versions 0.1.1240.1.1250.2.00.2.10.2.2 Show 11 moreShow less0.2.30.2.40.2.50.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.7 | None known |
What each source reports
GitHub Advisories Score usedGHSA-c7fq-p62p-wvpc
Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information.
- Record
GHSA-c7fq-p62p-wvpc- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862, CWE-1100
- Updated
- 2026-11-02
CVE ListNo score
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2024-7045- Updated
- 2026-11-02
EUVDEUVD-2025-6949
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
EUVD-2025-6949- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2024-7045- Updated
- 2026-11-02
OSV
Improper Access Control in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information.
- Record
CVE-2024-7045- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-c7fq-p62p-wvpc
Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information.
- Record
GHSA-c7fq-p62p-wvpc- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-1100, CWE-862
- Updated
- 2026-11-02
OSVPYSEC-2026-1727
Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information.
- Record
PYSEC-2026-1727- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.