CVSS 3.0
6.9 mediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:LCVE-2024-7035
Medium (6.9) in openwebui open webui. EPSS 8.7% chance of exploitation in the next 30 days. Fixed in open-webui 0.3.16.
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.
Severity
- EPSS
- 8.7% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openwebui:open_webui
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p5vx-9hj8-cf4h | PyPI | open-webui | <=0.3.8 | no fix published |
| PYSEC-2026-1739 | PyPI | open-webui | <0.3.16 | 0.3.16 |