All vulnerabilities
CVE-2024-7041GHSA-xcvc-5hgv-phqgPYSEC-2026-1744

open-webui Insecure Direct Object Reference (IDOR) vulnerability

open-webui open-webuipipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.7Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 9 Oct 2024. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed in0.6.3Fixed versionGitHub
Published9 Oct 2024Updated 26 Oct 2026CVE List

What fixes it

  • 0.6.3open-webui, pipGitHub
  • 0.6.3open-webui, PyPIOSVpip install "open-webui>=0.6.3"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint http://0.0.0.0:3000/api/v1/memories/{id}/update, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.

Text from CVE List

Affected versions 53

  • open-webui, pip< 0.6.3GitHub
  • open-webui/open-webuiaffected: unspecified through latestCVE List
  • open-webui, PyPIfrom first release, fixed in 0.6.3OSV
  • open-webui, PyPI0.1.124OSV
  • open-webui, PyPI0.1.125OSV
  • open-webui, PyPI0.2.0OSV
  • open-webui, PyPI0.2.1OSV
  • open-webui, PyPI0.2.2OSV
  • open-webui, PyPI0.2.3OSV
  • open-webui, PyPI0.2.4OSV
  • open-webui, PyPI0.2.5OSV
  • open-webui, PyPI0.3.0OSV
  • open-webui, PyPI0.3.1OSV
  • open-webui, PyPI0.3.10OSV
  • open-webui, PyPI0.3.12OSV
  • open-webui, PyPI0.3.13OSV
  • open-webui, PyPI0.3.14OSV
  • open-webui, PyPI0.3.15OSV
  • open-webui, PyPI0.3.16OSV
  • open-webui, PyPI0.3.17OSV
  • open-webui, PyPI0.3.17.dev2OSV
  • open-webui, PyPI0.3.17.dev3OSV
  • open-webui, PyPI0.3.17.dev4OSV
  • open-webui, PyPI0.3.17.dev5OSV
  • open-webui, PyPI0.3.18OSV
  • open-webui, PyPI0.3.19OSV
  • open-webui, PyPI0.3.2OSV
  • open-webui, PyPI0.3.20OSV
  • open-webui, PyPI0.3.21OSV
  • open-webui, PyPI0.3.22OSV
  • open-webui, PyPI0.3.23OSV
  • open-webui, PyPI0.3.24OSV
  • open-webui, PyPI0.3.25OSV
  • open-webui, PyPI0.3.26OSV
  • open-webui, PyPI0.3.27OSV
  • open-webui, PyPI0.3.27.dev1OSV
  • open-webui, PyPI0.3.27.dev2OSV
  • open-webui, PyPI0.3.27.dev3OSV
  • open-webui, PyPI0.3.28OSV
  • open-webui, PyPI0.3.29OSV
  • open-webui, PyPI0.3.3OSV
  • open-webui, PyPI0.3.30OSV
  • open-webui, PyPI0.3.30.dev1OSV
  • open-webui, PyPI0.3.30.dev2OSV
  • open-webui, PyPI0.3.31OSV
  • open-webui, PyPI0.3.31.dev1OSV
  • open-webui, PyPI0.3.32OSV
  • open-webui, PyPI0.3.33OSV
  • open-webui, PyPI0.3.33.dev1OSV
  • open-webui, PyPI0.3.34OSV
  • open-webui, PyPI0.3.35OSV
  • open-webui, PyPI0.3.4OSV
  • open-webui, PyPI0.3.5OSV

References 6