{"action":"Upgrade open-webui to 0.3.33 or later.","affected":[{"fixed":"0.3.33","introduced":"0"}],"component":"open-webui","cve_ids":["CVE-2024-7806"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.3.33"],"ghsa_id":"GHSA-85jc-8h5p-8vw8","id":"tcs_01M5KGVA8JY5R0RFC6Q274A008","modified_at":"2026-07-07T17:47:23.669252778Z","published_at":"2026-07-07T14:34:55.960523Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1724","https://nvd.nist.gov/vuln/detail/CVE-2024-7806","https://github.com/open-webui/open-webui/pull/6054","https://github.com/open-webui/open-webui/commit/7e253df17593bc12dc5cc89d28703675f05b0158","https://github.com/open-webui/open-webui","https://github.com/open-webui/open-webui/blob/1d20c27553f019477f01d7233ebe40b11d31e479/backend/main.py#L892-L920","https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8","https://pypi.org/project/open-webui","https://github.com/advisories/GHSA-85jc-8h5p-8vw8"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"PYSEC-2026-1724","url":"https://osv.dev/vulnerability/PYSEC-2026-1724"}],"summary":"Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability"}