-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies the /api/v1/auths/admin/details endpoint as the attack vector. In typical web application architecture, this endpoint would be handled by a controller function (e.g., get_admin_details) in the authentication/authorization routing layer. The vulnerability stems from missing authorization checks in this endpoint handler, allowing any authenticated user (PR:L in CVSS) to access admin details. While exact code isn't provided, the endpoint structure and vulnerability nature strongly suggest the handler function lacks role-based access control validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip |