CVE-2024-7046
Open WebUI Allows Viewing of Admin Details
CVE-2024-7046 has been rejected by its source and should not be treated as a live vulnerability, published March 20, 2025.
- Severity
- 4.3 MediumCVSS 3.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
open-webuiPyPI | through 0.3.8 | None known |
open-webuiPyPI | through 0.3.8, plus listed versions 0.1.1240.1.1250.2.00.2.10.2.2 Show 11 moreShow less0.2.30.2.40.2.50.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.7 | None known |
What each source reports
GitHub Advisories Score usedGHSA-gv26-qw3h-8qvp
Open WebUI Allows Viewing of Admin Details
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.
- Record
GHSA-gv26-qw3h-8qvp- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-475, CWE-862
- Updated
- 2026-11-02
CVE ListNo score
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2024-7046- Updated
- 2026-11-02
EUVDEUVD-2025-6947
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
EUVD-2025-6947- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2024-7046- Updated
- 2026-11-02
OSV
Improper Access Control in open-webui/open-webui
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.
- Record
CVE-2024-7046- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-gv26-qw3h-8qvp
Open WebUI Allows Viewing of Admin Details
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.
- Record
GHSA-gv26-qw3h-8qvp- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-475, CWE-862
- Updated
- 2026-11-02
OSVPYSEC-2026-1735
Open WebUI Allows Viewing of Admin Details
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin (owner) details.
- Record
PYSEC-2026-1735- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.