CVE-2024-7046
| CVE ID | CVE-2024-7046 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | Medium (CVSS 4.3, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) |
GET /api/v1/auths/admin/details exists to tell a user awaiting approval who to contact in order to get approved. Non-administrators are its entire purpose. It returns two fields, the instance owner's display name and contact email, and it returns them only while the administrator has SHOW_ADMIN_DETAILS switched on. With that setting off the endpoint returns HTTP 400 and discloses nothing.
Restricting it to administrators, as the report asks, would remove its only function and leave pending users with no way to reach the person who can approve them. Nothing is bypassed: the data is published deliberately, through a dedicated toggle, to the audience it was built for.
This is not a subtle finding that reasonable reviewers could differ on. The endpoint returns a name and an email address that an administrator opted to publish, to the users it exists to serve. A record was nonetheless minted, scored 4.3 Medium as missing authorization, and published against this project, where it has stood for over a year.
Timeline
Open WebUI rejects this record as not a vulnerability; the assessment below is the project's official position. The issuing CNA has not responded and has not acted on the record, so the dispute has been escalated to the CVE Program Root.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as not a vulnerability. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
As of 2026-08-08, the record is still in the PUBLISHED state on cve.org and the dispute is before the CVE Program Root. This disposition stands as Open WebUI's official assessment.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.8, the endpoint GET /api/v1/auths/admin/details returns the instance owner's details without verifying that the caller is an administrator, so any authenticated user can call it and retrieve the first administrator (owner) account's details. The record classifies this as CWE-862 (Missing Authorization) and scores it CVSS 4.3 (Medium).
Why This Is Not a Vulnerability
The /api/v1/auths/admin/details endpoint is the intended mechanism for showing the instance owner's contact details to the instance's users. It exists so that a pending user knows who to contact for approval. Non-administrators are that endpoint's entire intended audience: it is designed to be queryable by any pending or approved user, and the owner's name and email are displayed directly on the account-pending screen. The intent could not be more explicit. Restricting the endpoint to administrators would defeat its entire purpose.
It Returns Only Contact Information, and Only When the Admin Intends It
The handler returns exactly two fields, the administrator's display name and email, and nothing else. No credentials, tokens, roles, session data, configuration, or any other user's data are exposed. Those two fields are the owner's contact details, and surfacing them when the feature is enabled is the entire point: a pending user needs a way to reach whoever can approve their account, and this endpoint is that way. Exposing the owner's contact point to the users who need it is the feature, not a leak.
The disclosure is gated by the SHOW_ADMIN_DETAILS setting (auth.admin.show). When an administrator turns it off, the endpoint returns HTTP 400 and discloses nothing at all. Whether the owner's contact details are visible is therefore a per-instance configuration decision that the administrator controls, not a flaw. Configuration options and expected behavior are not vulnerabilities.
The Data Is a Contact Primitive, Not a Secret
The "attacker" in this report is an authenticated user of the same self-hosted instance, and the "victim" is the instance owner whose contact email the administrator has chosen to publish. In Open WebUI's single-trust-domain, authenticated, role-based model, showing the owner's name and contact email to that instance's own authenticated users is a collaboration and contact primitive, not a data breach. Treating it as one misreads the architecture.
CWE-862 Is Misapplied
CWE-862 (Missing Authorization) describes a resource that should be gated by an authorization check but is not. That is not what this endpoint is. It requires an authenticated session (Depends(get_current_user)) and then returns data the administrator has explicitly opted to publish via SHOW_ADMIN_DETAILS. No authorization control is being bypassed.
The report does not describe the bypass of an existing control. It asserts that an administrator-only check should exist on an endpoint that is deliberately not administrator-only, precisely because its function is to serve non-administrators. An expectation that a control should exist where one was never intended is not CWE-862.
Severity
Because this is intended, administrator-controlled behavior, no CVSS score applies to it. Separately, and only if the record is scored at all, the C:L confidentiality impact overstates it: the only data returned is a display name and a contact email that the administrator has chosen to expose through a dedicated toggle, and when that toggle is off the endpoint returns nothing.
Applicable Security Policy Rules
- Rule 1: Configuration options and expected behavior are not vulnerabilities. The endpoint exposes the owner's contact details by design, under an administrator-controlled setting, and crosses no security boundary.
- Rule 7: The report treats authenticated-user visibility of the owner's contact details in a self-hosted, single-trust-domain instance as a data-exposure flaw, which misreads the project's architecture.
Impact to Users
No action required. The endpoint returns only the administrator's display name and contact email, and only when SHOW_ADMIN_DETAILS is enabled. If you do not want the owner's contact details visible to authenticated users of your instance, set SHOW_ADMIN_DETAILS to false (auth.admin.show), and the endpoint will disclose nothing.