Executive brief
Open WebUI, a popular interface for interacting with Large Language Models (LLMs), contains a flaw in how it handles new user registrations. When new sign-ups are enabled, users are initially placed in a 'pending' state requiring administrator approval; however, due to a missing check, these unapproved users can bypass the interface and directly use the system's functions via its programming interface (API). This allows unauthorized individuals to interact with AI models and access system information without being approved by an administrator.
Technical details
Open WebUI (formerly Ollama WebUI) fails to properly enforce user role restrictions at the API layer. While the frontend correctly restricts users with a 'pending' role from accessing the dashboard, the backend 'get_current_user' dependency only validates the presence of a valid JWT and does not verify if the user's role is 'user' or 'admin'. An attacker can register a new account, receive a JWT with a 'pending' role, and then use that token to successfully query authenticated endpoints such as '/ollama/api/tags' or interact with LLMs. The vulnerability is mitigated by replacing 'get_current_user' with 'get_verified_user' in affected API routes to ensure role-based access control is enforced.
Affected products
- Open WebUI Open WebUI <= 0.1.123
Timeline
- 2024-06-11: disclosed: Vulnerability submitted by KoreLogic
- 2026-05-05: advisory: GitHub Advisory published
References
- https://api.github.com/users/KoreLogicSecurityDisclosures
- https://github.com/KoreLogicSecurityDisclosures
- https://api.github.com/users/KoreLogicSecurityDisclosures/gists%7B/gist_id%7D
- https://api.github.com/users/KoreLogicSecurityDisclosures/repos
- https://avatars.githubusercontent.com/u/163048701?v=4
- https://api.github.com/users/KoreLogicSecurityDisclosures/events%7B/privacy%7D