← Database

CVE-2024-7049

MEDIUM CVSS: 5.4 Published: 2024-10-10 Modified: 2026-06-17

Description

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.

Affected Platforms

Openwebui Open Webui

Weakness Type

CWE-488, NVD-CWE-Other

References