CVE-2024-8053CWE-306

Improper Authentication in open-webui/open-webui

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00652 · 50.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-03-20T10:11Z
EPSS history
Timeline
  • 20 MAR 10:11Z
    Improper Authentication in open-webui/open-webui
    cvelistv5