Openwebui

Open Webui

142 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.2

CVE-2024-7033

Exploit
  • EPSS 1.13%
  • Veröffentlicht 20.03.2025 10:09:54
  • Zuletzt bearbeitet 16.07.2026 16:17:19

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

7.5

CVE-2024-12537

Exploit
  • EPSS 0.89%
  • Veröffentlicht 20.03.2025 10:09:10
  • Zuletzt bearbeitet 13.08.2026 15:17:55

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

7.5

CVE-2024-9840

  • EPSS 0.09%
  • Veröffentlicht 20.03.2025 10:09:04
  • Zuletzt bearbeitet 15.04.2025 16:15:47

Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-53981. Notes: All CVE users should reference CVE-2024-53981 instead of this CVE Record. All references and descriptions in this candidate ...

7.7

CVE-2024-7959

Exploit
  • EPSS 24.46%
  • Veröffentlicht 20.03.2025 10:09:00
  • Zuletzt bearbeitet 16.07.2026 16:18:43

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

8.4

CVE-2024-7990

Exploit
  • EPSS 0.9%
  • Veröffentlicht 20.03.2025 10:08:55
  • Zuletzt bearbeitet 13.08.2026 15:19:13

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

5.4

CVE-2024-7049

Exploit
  • EPSS 0.35%
  • Veröffentlicht 10.10.2024 08:15:03
  • Zuletzt bearbeitet 17.10.2024 14:22:44

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.

5.4

CVE-2024-7048

Exploit
  • EPSS 0.37%
  • Veröffentlicht 10.10.2024 02:15:03
  • Zuletzt bearbeitet 15.10.2025 13:15:51

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a ...

6.5

CVE-2024-7041

Exploit
  • EPSS 0.37%
  • Veröffentlicht 09.10.2024 20:15:09
  • Zuletzt bearbeitet 15.10.2025 13:15:51

An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allo...

2.7

CVE-2024-7038

Exploit
  • EPSS 0.35%
  • Veröffentlicht 09.10.2024 19:15:14
  • Zuletzt bearbeitet 16.07.2026 16:18:07

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

6.1

CVE-2024-6706

Exploit
  • EPSS 0.66%
  • Veröffentlicht 07.08.2024 23:15:41
  • Zuletzt bearbeitet 21.11.2024 09:50:09

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.