A stored Cross-site Scripting vulnerability in Open WebUI versions prior to 0.8.0 allows high-privileged users to execute malicious scripts in the context of other users' sessions.

This vulnerability (CWE-79) occurs because input is not properly neutralized during web page generation, allowing an attacker with high privileges to perform XSS attacks.

The CVSS score of 8.1 highlights the danger of session hijacking and unauthorized actions performed on behalf of other users. By injecting malicious scripts, an attacker could steal session cookies or perform administrative tasks, leading to the full compromise of user accounts and potential data exfiltration.

Immediate Action: Update Open WebUI to version 0.8.0 or later to ensure proper sanitization of user-supplied input.

Proactive Monitoring: Monitor for anomalous script tags or unexpected content modifications within the web interface.

Compensating Controls: Utilize a Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser.

Public Exploit Available: Unknown

While this vulnerability requires high-level privileges to initiate, the potential for widespread impact on other users necessitates immediate patching. Updating to version 0.8.0 or higher is the only effective way to neutralize the XSS vector.