Open WebUI versions 0.10.0 through 0.10.x contain authorization vulnerabilities that could allow authenticated users to exceed their intended privileges and compromise system integrity.

The software fails to properly enforce authorization checks (CWE-862 and CWE-863), allowing an authenticated user to perform restricted operations.

With a CVSS score of 8.1, these authorization flaws pose a significant threat to the security of the AI platform. A malicious or compromised authenticated user could manipulate system settings or trigger unauthorized actions, leading to a loss of data integrity and potential service disruption.

Immediate Action: Update Open WebUI to version 0.11.0 or later to apply the necessary authorization fixes.

Proactive Monitoring: Monitor audit logs for unusual administrative activity or unauthorized modifications performed by standard user accounts.

Compensating Controls: Restrict access to the Open WebUI instance to trusted networks and enforce the principle of least privilege for all platform users.

Public Exploit Available: No

The update to version 0.11.0 is essential to restore proper access control enforcement. Administrators should verify the patch deployment across all instances and review user permissions to ensure no unauthorized configurations were established prior to the update.