| Package | Affected versions | Patched versions |
|---|---|---|
| open-webui | < 0.6.3 | 0.6.3 |
| open webui | = 0.3.8 |
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint http://0.0.0.0:3000/api/v1/memories/{id}/update, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free