CVE-2024-7045
| CVE ID | CVE-2024-7045 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | Medium (CVSS 4.3, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) |
Timeline
Open WebUI rejects this record as not a vulnerability; the assessment below is the project's official position. The issuing CNA has not responded and has not acted on the record, so the dispute has been escalated to the CVE Program Root.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as not a vulnerability. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
As of 2026-08-08, the record is still in the PUBLISHED state on cve.org and the dispute is before the CVE Program Root. This disposition stands as Open WebUI's official assessment.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.8, the endpoints GET /api/v1/prompts/ and GET /api/v1/prompts/command/{command} return prompt data to any authenticated (verified) user without verifying that the caller is an administrator. The report states that a verified user can list every prompt (including its command identifier) through /api/v1/prompts/, then read any prompt's content through /api/v1/prompts/command/{command}. The record classifies this as CWE-862 (Missing Authorization) and scores it CVSS 4.3 (Medium).
Why This Is Not a Vulnerability
In this version, prompts are a global, instance-wide shared resource by construction. The Prompt schema is command, user_id, title, content, timestamp. There is no access_control field, no public/private flag, and no per-prompt sharing model. There is therefore nothing private to leak: every prompt is a shared slash-command template intended to be invoked by all users in chat. Reading the prompt list and a prompt's content is the feature, it is how a user picks and runs a command such as /summarize in the message composer.
Read Is Intended, Only Mutation Is Restricted
The design is deliberate, and the only restriction it defines is enforced. Reads are open to verified users; writes are administrator-only:
GET /api/v1/prompts/→get_verified_userGET /api/v1/prompts/command/{command}→get_verified_userPOST /api/v1/prompts/create,POST /api/v1/prompts/command/{command}/update,DELETE /api/v1/prompts/command/{command}/delete→get_admin_user
Administrators author shared prompts, and every verified user reads and uses them. The report's claim that "the application does not verify whether the attacker is an administrator" describes intended behavior: read access was never administrator-gated, only creation and editing were, and that check is present and enforced.
CWE-862 Is Misapplied
CWE-862 (Missing Authorization) describes a resource that should be gated by an authorization check but is not. Read access to shared prompts is intentionally available to verified users; no authorization control is missing or being bypassed. The report asserts an administrator-only read restriction that was never part of the design, on a resource that is shared by construction. Nor is there any per-prompt isolation model that could be "insufficiently" enforced: in this version prompts are global, so there is no isolation boundary to violate.
Severity
Because this is intended, documented shared-workspace behavior, no CVSS score applies to it. Separately, and only if the record is scored at all, the C:L confidentiality impact overstates it: the data returned is a shared slash-command template that every verified user is meant to read and run.
Applicable Security Policy Rules
- Rule 1: Expected, documented shared-workspace behavior is not a vulnerability. Prompts are shared by design; only their creation and editing is restricted, and that restriction is enforced. No security boundary is crossed.
- Rule 7: Administrator-created shared prompts being readable by authenticated peers is intended collaboration in a self-hosted, single-trust-domain instance, not an authorization flaw. There is no per-prompt isolation model in the product to violate.
Impact to Users
No action required. In this version, prompts are shared slash-command templates that every verified user can read and invoke by design; only their creation and editing is restricted to administrators, and that restriction holds. There is no private-prompt concept in this schema for the cited endpoints to expose.