CVE-2024-7048 IDOR in open-webui/open-webui

Medium 6.3 Published 10 Oct 2024 Updated 15 Oct 2025

A lower-privileged user can access and overwrite admin-managed files in Open WebUI, compromising data integrity and availability.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-7048?

CVE-2024-7048 is a medium-severity missing authorization vulnerability in Openwebui Open Webui, published on 10 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity and availability of the RAG models.

Weakness: CWE-863

Which versions are affected by CVE-2024-7048?

It affects 1 product.

Products include Openwebui Open Webui.

How do I fix CVE-2024-7048?

No fix has been published for CVE-2024-7048 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-7048 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-7048 exists.

All Openwebui Open Webui vulnerabilities

Sources

Also known as GHSA-f378-qx8v-c7cf.