Executive brief
Open WebUI is a user interface for interacting with large language models. A security flaw was identified where the configuration interface did not require a password, potentially allowing unauthorized users to view sensitive system settings. However, this specific report was later withdrawn by the maintainers after further investigation determined it did not pose a significant security risk.
Technical details
An authentication bypass vulnerability was initially reported in Open WebUI versions up to 0.6.32. The issue resided in the /api/config endpoint, which reportedly lacked proper authentication and authorization controls (CWE-306). This would allow a remote, unauthenticated attacker to access sensitive system configuration data via a simple network request. Following the initial disclosure, the CVE was rejected and withdrawn by the CNA because further investigation indicated the behavior was not a security issue. Security engineers should note that while the CVE is rejected, ensuring that configuration endpoints are properly restricted remains a best practice.
Affected products
- Open WebUI Open WebUI <= 0.6.32
Timeline
- 2025-12-18: disclosed: Initial vulnerability report published
- 2026-06-29: other: CVE record rejected and withdrawn by the CNA