HIGH 8.3
GHSA-pqwr-phvv-v49f
Open WebUI Allows Admin Deletion via API Endpoint
Details
In open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability. The application allows an attacker, acting as an admin, to delete other administrators via the API endpoint `http://0.0.0.0:8080/api/v1/users/{uuid_administrator}`. This action is restricted by the user interface but can be performed through direct API calls.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI / open-webui
Introduced in:
0 No fixed version published yet for open-webui (pip). Pin to a known-safe version or switch to an alternative.