Skip to main content

Missing Authorization

CVE-2024-7043

High
8.8/10

Summary

An improper access control vulnerability in open-webui/open-webui versions 0.3.6 and after allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the "GET /api/v1/files/" interface to retrieve information on all files uploaded by users, which includes the "ID" values. The attacker can then use the "GET /api/v1/files/{file_id}" interface to obtain information on any file and the "DELETE /api/v1/files/{file_id}" interface to delete any file.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published