Executive brief
Open WebUI is an interface for interacting with Large Language Models (LLMs) that supports 'tools' for extending AI capabilities. A security flaw in the chat completion system allows users to bypass restrictions and use tools they are not authorized to access, including private or administrative tools. This could allow a regular user to perform unauthorized actions or access sensitive data by leveraging the server's own high-level credentials.
Technical details
A missing authorization check (CWE-862) exists in the chat completion API of Open WebUI. The `tool_ids` and `tool_servers` parameters are user-supplied and processed by middleware to resolve tools via `get_tool_by_id`. However, the system fails to verify if the requesting user has the appropriate permissions or group memberships to access the requested tool. An attacker with low-level API access can provide the ID of a restricted or private tool (such as an MCP server tool) in their request. Because the tool is then executed using the server's stored authentication tokens, the attacker can perform actions with elevated server-side privileges. This was addressed by implementing group-based membership checks and connection access verification in versions 0.7.0 and 0.8.6.
Affected products
- Open WebUI open-webui <= 0.8.5
Timeline
- 2026-02-27: patched: Initial fix for MCP server resolution logic.
- 2026-05-09: disclosed: Vulnerability reported and published.
- 2026-05-14: advisory: GitHub Advisory published.