CVE-2024-7045Medium· 4.3▾ SunlitRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
open-webui <= 0.3.8Connected by shared product, vendor, weakness, or advisory.
GHSA-w466-2wfc-8g58High· 7.5Open WebUI has vulnerable dependency on starlette via fastapi
CVE-2026-56400High· 8.3Open WebUI has a CORS misconfiguration and session validation issue
CVE-2026-56398High· 7.3Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
CVE-2026-45666Medium· 6.5Open WebUI has an Indirect Object Reference (IDOR) in user notes
CVE-2026-45385Medium· 4.3Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint
CVE-2026-29071Low· 3.1Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories