{"action":"Upgrade open-webui to 0.3.33 or later.","affected":[{"fixed":"0.3.33","introduced":"0"}],"component":"open-webui","cve_ids":["CVE-2024-7806"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.3.33"],"ghsa_id":"GHSA-85jc-8h5p-8vw8","id":"tcs_01M5KF7BTJ0K5G7754C7QHZTT2","modified_at":"2026-07-07T17:56:12.452785614Z","published_at":"2025-03-20T12:32:46Z","references":["https://osv.dev/vulnerability/GHSA-85jc-8h5p-8vw8","https://nvd.nist.gov/vuln/detail/CVE-2024-7806","https://github.com/open-webui/open-webui/pull/6054","https://github.com/open-webui/open-webui/commit/7e253df17593bc12dc5cc89d28703675f05b0158","https://github.com/open-webui/open-webui","https://github.com/open-webui/open-webui/blob/1d20c27553f019477f01d7233ebe40b11d31e479/backend/main.py#L892-L920","https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-85jc-8h5p-8vw8","url":"https://osv.dev/vulnerability/GHSA-85jc-8h5p-8vw8"}],"summary":"Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability"}