CVE-2024-7045
mediumrejectedpriority · track · 0OT risk · elevatedEUUSRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cvss
Technical severity, 0–10. One row per scoring source.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-c7fq-p62p-wvpcOpen WebUI Has Improper Access Control Leading to Arbitrary Prompt Read2025-03-20ghsa · osvUS
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information.
- PYSEC-2026-1727Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read2026-07-07vendor · osvUS
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (1) cnnvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan