CVE-2024-7049

Published: 2024-10-10T08:15Z

Last Modified: 2024-10-17T14:22Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt