CVE-2024-7040
Published: 20 March 2025
Summary
CVE-2024-7040 is a medium-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Openwebui Open Webui. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked in the top 44.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6948
Vulnerability details
In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the user_id parameter, it is possible to view the…
more
chats of any administrator, including those of other admin (owner) accounts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The improper access control vulnerability (IDOR via user_id parameter manipulation) enables adversaries with admin access to collect unauthorized data (chats) from the Open WebUI information repository belonging to other administrators.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.