CVE Vulnerabilities

CVE-2024-7043

Incorrect Synchronization

Published: Mar 20, 2025 | Modified: Jul 18, 2025
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all files uploaded by users, which includes the ID values. The attacker can then use the GET /api/v1/files/{file_id} interface to obtain information on any file and the DELETE /api/v1/files/{file_id} interface to delete any file.

Weakness

The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

Affected Software

Name Vendor Start Version End Version
Open_webui Openwebui 0.3.8 (including) 0.3.8 (including)

References