CVE-2024-7048 - CVE House
Back to Database
Status published Medium CVE-2024-7048

IDOR in open-webui/open-webui

Vulnerability Description

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity and availability of the RAG models.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7048

Credits & Attribution

No credits recorded in the NVD database.

References

More from open-webui

View All →
CVE-2025-65959
Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'
High 8.7
CVE-2025-65958
Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
High 8.5
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
High 7.3
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
High 8.7
CVE-2025-46719
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
Medium 5.4

Affected Vendor

Affected Software

open-webui/open-webui
Vulnerable Versions:
unspecified

Timeline

Official Publish: October 10th, 2024
Last Modified: October 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion