Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2024-7806 on 16 October 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
CVE-2024-7806
Remote Code Execution by Non-Admin Users via CSRF in open-webui/open-webui
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
INFO
Published Date :
March 20, 2025, 10:15 a.m.
Last Modified :
Oct. 16, 2026, 2:10 p.m.
Remotely Exploit :
—
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.0 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | [email protected] |
Public PoC/Exploit Available at Github
CVE-2024-7806 has a 2 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
RCE exploit for low privileged user via CSRF in open-webui
csrf hack-tool open-webui rce-exploit
Python Shell HTML
None
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-7806 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-7806 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 16, 2026
Action Type Old Value New Value Changed Translation Title: rechazado, Description: Motivo del rechazo: Este ID de CVE ha sido rechazado o retirado por su Autoridad de Numeración de CVE (CNA). Title: rechazado, Description: Motivo del rechazo: Este ID de CVE ha sido rechazado o retirado por su Autoridad de Numeración de CVE (CNA). -
CVE Translated by [email protected]
Oct. 15, 2026
Action Type Old Value New Value Changed Translation Title: open-webui/open-webui, Description: Una vulnerabilidad en las versiones de open-webui/open-webui anteriores a la 0.3.8 permite la ejecución remota de código por parte de usuarios no administradores mediante Cross-Site Request Forgery (CSRF). La aplicación utiliza cookies con el atributo SameSite configurado como laxo para la autenticación y carece de tokens CSRF. Esto permite a un atacante manipular un HTML malicioso que, al ser accedido por la víctima, puede modificar el código Python de una canalización existente y ejecutar código arbitrario con los privilegios de la víctima. Title: rechazado, Description: Motivo del rechazo: Este ID de CVE ha sido rechazado o retirado por su Autoridad de Numeración de CVE (CNA). -
CVE Rejected by [email protected]
Sep. 03, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Sep. 03, 2026
Action Type Old Value New Value Changed Description A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim's privileges. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed CVSS V3.1 NIST: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Removed CVSS V3 huntr.dev: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Removed CWE huntr.dev: CWE-352 Removed CPE Configuration OR *cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* versions up to (including) 0.3.8 Added Affected Affected value removed. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2024/7xxx/CVE-2024-7806.json">CVE-2024-7806</a> Removed Reference huntr.dev: https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8 Removed Reference CISA-ADP: https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8 Removed Reference Type huntr.dev: https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8 Types: Exploit, Third Party Advisory Removed Reference Type CISA-ADP: https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8 Types: Exploit, Third Party Advisory Removed SSVC {'id': 'CVE-2024-7806', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-03-20T15:21:31.372657Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2024-7806', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-03-20T15:21:31.372657Z'} -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'open-webui', 'product': 'open-webui/open-webui', 'versions': [{'status': 'affected', 'version': 'unspecified', 'versionType': 'custom', 'lessThanOrEqual': 'latest'}]}] -
Initial Analysis by [email protected]
Mar. 26, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* versions up to (including) 0.3.8 Added Reference Type CISA-ADP: https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8 Types: Exploit, Third Party Advisory Added Reference Type huntr.dev: https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8 Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Mar. 20, 2025
Action Type Old Value New Value Added Reference https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8 -
New CVE Received by [email protected]
Mar. 20, 2025
Action Type Old Value New Value Added Description A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim's privileges. Added CVSS V3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-352 Added Reference https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8