{"id":"CVE-2024-7035","aliases":["GHSA-p5vx-9hj8-cf4h","PYSEC-2026-1739"],"title":"Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)","summary":"Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)","severity":"medium","cvss":6.9,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L","vendor":"open-webui","product":"open-webui","ecosystem":"pip","affected":["open-webui <= 0.3.8"],"published":"2025-03-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-p5vx-9hj8-cf4h","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7035"},{"url":"https://github.com/open-webui/open-webui"},{"url":"https://huntr.com/bounties/2ac81740-410b-467a-9244-75d82a6f9e11"}],"tags":["osv","pip"],"epss":0.08391,"epssPercentile":0.94722,"ingestedAt":"2026-07-08T18:25:51.525Z","slug":"CVE-2024-7035","body":"## Overview\n\nIn version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.\n\n## Affected packages\n\n- `open-webui <= 0.3.8`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":40,"depthScoreParts":{"impact":38,"likelihood":1.7,"exploitation":0,"ransomware":0},"changes":[{"seq":163,"id":"CVE-2024-7035","ts":1787603569549,"field":"epss","old":"0.00244","new":"0.08317"}]}