{"id":"CVE-2024-7041","kind":"vulnerability","aliases":["CVE-2024-7041","GHSA-xcvc-5hgv-phqg"],"related":[],"title":"open-webui Insecure Direct Object Reference (IDOR) vulnerability","description":"An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.","summary":"Open WebUI's memory update endpoint does not check that the caller owns the memory, so a logged-in user can change memories belonging to other users. An attacker gets write access to other users' stored memory content.","severity":"medium","cvss":6.5,"epss":0.00367,"exploited":false,"exploited_at":null,"products":[{"name":"open-webui","fixed":["0.6.3"],"affected":"< 0.6.3","ecosystem":"pypi"},{"name":"openwebui open webui","fixed":[],"affected":"= 0.3.8","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-apps","ai-tooling","cwe-250","cwe-639","open-webui","python","self-hosted"],"not_affected_if":["single-user","version-0.6.3-or-later"],"how_to_check":"- Check the installed version with `pip show open-webui` and compare it to `0.6.3`.\n- Review the memory update route under `/api/v1/memories/{id}/update` to see whether it verifies the memory belongs to the requesting user.","fix":"- Upgrade `open-webui` to `0.6.3` or later.","status":"open","published_at":"2024-10-09T20:15:09+00:00","first_seen_at":"2026-10-26T15:12:52+00:00","triaged_at":"2026-10-26T15:13:41+00:00","updated_at":"2026-10-26T16:02:26+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T15:13:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `open-webui` to `0.6.3` or later.","reach":"network","title":"Open WebUI: any user can edit other users' memories via IDOR","impact":"medium","summary":"Open WebUI's memory update endpoint does not check that the caller owns the memory, so a logged-in user can change memories belonging to other users. An attacker gets write access to other users' stored memory content.","category":"ai-tooling","nicknames":[],"who_cares":["open-webui","python","self-hosted","ai-apps"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker edits other users' stored memories without authorization","analyst_note":"","how_to_check":"- Check the installed version with `pip show open-webui` and compare it to `0.6.3`.\n- Review the memory update route under `/api/v1/memories/{id}/update` to see whether it verifies the memory belongs to the requesting user.","needs_analyst":false,"not_affected_if":["version-0.6.3-or-later","single-user"],"who_is_affected":"Teams that run Open WebUI with multiple user accounts and the memories feature in use are exposed, since any authenticated user can reach the memory update endpoint. Single-user deployments where only one person has an account are much less exposed, and teams on `0.6.3` or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000584,"input_tokens":3393,"output_tokens":489,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,19A '-250':34B '-639':36B '-7041':12A,20A '/open-webui':95C '/update':108C '0.0.0.0':105C '3000/api/v1/memories':106C '5hgv':16A 'access':76B 'ai':28B,31B 'ai-app':27B 'ai-tool':30B 'allow':115C 'api':103C 'app':29B 'attack':73B,116C 'author':124C 'belong':68B 'caller':55B 'chang':66B 'check':52B 'content':82B 'cve':10A,18A 'cwe':33B,35B 'decentr':111C 'design':112C 'direct':5A,85C 'edit':118C 'endpoint':49B,104C 'exist':90C 'flaw':114C 'get':74B 'ghsa':14A 'ghsa-xcvc-5hgv-phqg':13A 'host':43B 'id':107C 'idor':8A,88C 'insecur':4A,84C 'log':62B 'logged-in':61B 'memori':47B,58B,67B,81B,121C 'object':6A,86C 'occur':100C 'open':2A,22A,25A,38B,44B,93C 'open-webui':1A,21A,37B,92C 'openwebui':24A 'own':56B 'phqg':17A 'proper':123C 'python':40B 'refer':7A,87C 'self':42B 'self-host':41B 'store':80B 'tool':32B 'updat':48B 'user':64B,71B,79B,120C 'v0.3.8':97C 'version':96C 'vulner':9A,89C,99C 'webui':3A,23A,26A,39B,45B,94C 'without':122C 'write':75B 'xcvc':15A","nicknames":[],"mitigations":[],"who_affected":"Teams that run Open WebUI with multiple user accounts and the memories feature in use are exposed, since any authenticated user can reach the memory update endpoint. Single-user deployments where only one person has an account are much less exposed, and teams on `0.6.3` or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-09T20:15:09+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xcvc-5hgv-phqg","url":"https://github.com/advisories/GHSA-xcvc-5hgv-phqg","severity":"medium","published_at":"2024-10-09T21:31:08+00:00","modified_at":"2026-10-26T15:08:56+00:00","first_seen_at":"2026-10-26T15:12:52+00:00","fetched_at":"2026-10-26T15:12:52+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-7041","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7041","severity":null,"published_at":"2024-10-09T20:15:09+00:00","modified_at":"2026-06-17T08:19:15+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}