Open WebUIGHSA-xcvc-5hgv-phqg
open-webui Insecure Direct Object Reference (IDOR) vulnerability
Medium6.5CVE-2024-7041 · Published Oct 9, 2024 · updated Jul 7, 2026
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| open-webui PyPI | <= 0.3.8 | No fix yet |
Details and references
More Open WebUI advisories
All Open WebUI| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | Open WebUI Uncontrolled Resource Consumption vulnerability High7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Open WebUI has vulnerable dependency on starlette via fastapiHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Open WebUI Uncontrolled Resource Consumption vulnerabilityHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Open WebUI Uncontrolled Resource Consumption vulnerabilityHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Oct 92024 | open-webui allows writing and deleting arbitrary filesMedium6.5Oct 9, 2024 | Medium6.5 | No fix yet |
| Aug 82024 | Open WebUI Stored Cross-Site Scripting VulnerabilityMedium6.1Aug 8, 2024 | Medium6.1 | No fix yet |