CVE-2024-7039: Open WebUI admin deletion via API endpoint

Executive brief

Open WebUI is a user-friendly interface for interacting with AI models. This advisory has been withdrawn because it does not describe a valid vulnerability. The originally reported issue claimed that admins could delete other administrators through direct API calls, though the user interface blocked such actions. However, further review determined this was not an actual security flaw, and the advisory was retracted in September 2026.

Technical details

The original report (CVE-2024-7039) described an improper privilege management vulnerability (CWE-269, CWE-863) in Open WebUI version ≤0.3.8 where an authenticated admin could delete other admin accounts by sending direct HTTP DELETE requests to the `/api/v1/users/{uuid_administrator}` endpoint, bypassing UI-level restrictions. The attack required admin privileges and network access but no additional user interaction. However, this advisory was withdrawn on September 2, 2026, with the determination that it does not describe a valid vulnerability. No patched version was ever released, and the advisory is maintained only for external reference preservation.

Affected products

• Open WebUI Open WebUI <=0.3.8

Timeline

• 2025-03-20: disclosed: Advisory published to GitHub Advisory Database
• 2026-09-02: other: Advisory withdrawn; determined to not describe a valid vulnerability

References

• https://api.github.com/users/Classic298
• https://github.com/Classic298
• https://api.github.com/users/Classic298/gists%7B/gist_id%7D
• https://api.github.com/users/Classic298/repos
• https://avatars.githubusercontent.com/u/27028174?v=4
• https://api.github.com/users/Classic298/events%7B/privacy%7D