What is CVE-2024-7043?

CVE-2024-7043 is a high-severity vulnerability in Open-webui Open-webui/open-webui, classified under Missing Authorization. CVSS score: 8.8/10. Published 2025-03-20.

How severe is CVE-2024-7043?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Open-webui Open-webui/open-webui

CVE-2024-7043

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GE…

Vulnerability class: Broken Access Control

EPSS: 0.006 (43.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Open-webui Open-webui/open-webui — versions unspecified
Openwebui Open_webui — versions 0.3.8

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-7043?: CVE-2024-7043 is a high-severity vulnerability in Open-webui Open-webui/open-webui, classified under Missing Authorization. CVSS score: 8.8/10. Published 2025-03-20.
How severe is CVE-2024-7043?: High severity. CVSS v3 base score is 8.8 out of 10.