MEDIUMCVSS 5.7EPSS 0.4%

CVE-2024-7041

open-webui Insecure Direct Object Reference (IDOR) vulnerability

Published: 2024-10-09
Modified: 2026-10-26
EPSS percentile: 30%
Aliases: GHSA-xcvc-5hgv-phqg
Sources: github-advisory

Summary

An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	open-webui	—	0.6.3

Remediation: Upgrade to 0.6.3 or later.

References

https://github.com/advisories/GHSA-xcvc-5hgv-phqg

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.