CVE-2024-7039: 
Python vulnerability analysis and mitigation

In open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability identified as CVE-2024-7039. The vulnerability was disclosed on March 20, 2025, and affects the administrative access control mechanisms of the application (NVD).

The vulnerability stems from improper privilege management in the API endpoint http://0.0.0.0:8080/api/v1/users/{uuid_administrator}. While the user interface restricts administrative deletion actions, these restrictions can be bypassed through direct API calls. The vulnerability has been assigned a CVSS v3.0 base score of 8.3 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, indicating a serious security issue (NVD).

The vulnerability allows an attacker with admin access to delete other administrators through direct API calls, bypassing intended access controls. This could lead to privilege escalation and potential disruption of administrative access management (NVD).