Open-WebUI Access Control Vulnerability Allowing Unauthorized Admin Detail Access

A vulnerability in Open-WebUI version 0.3.8 allows attackers to access admin details due to improper access control. The application fails to verify if the requester is an administrator, enabling direct calls to the '/api/v1/auths/admin/details' endpoint to retrieve information about the first admin (owner).

Impact

Exploitation of this vulnerability allows unauthorized users to view sensitive admin information, including email and name details.

Reproduction

To reproduce this vulnerability, send a GET request to the '/api/v1/auths/admin/details' endpoint. Include an Authorization header with a valid bearer token. The request can be made using tools like cURL or Postman.