| |
Vulnerability CVE-2024-7049
Published: 2024-10-10
| Description: |
In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process. |
Type:
CWE-488 (Exposure of Data Element to Wrong Session)
References: |
https://huntr.com/bounties/ee9e3532-8ef1-4599-bb59-b8e2ba43a1fc
|
|
|
Copyright 2026, cxsecurity.com
|
|
|
