Executive brief
Open WebUI, a popular interface for interacting with large language models, contains a flaw that allows any logged-in user to view and terminate background tasks belonging to other users. This means a malicious user could disrupt the service for everyone else by repeatedly stopping their chat generations or data processing tasks. The vulnerability effectively allows a low-privilege user to perform a denial-of-service attack against the entire platform.
Technical details
Open WebUI suffers from broken object-level authorization (BOLA) in its task management API. The endpoints `GET /api/tasks` and `POST /api/tasks/stop/{task_id}` use the `get_verified_user` dependency, which permits any authenticated user (including non-admins) to access a global task namespace. Because the backend fails to verify task ownership before listing or stopping a task, an attacker can enumerate all active task IDs and terminate them regardless of who started them. This can be exploited to cause a persistent denial-of-service against chat generation and background indexing. The issue is fixed in version 0.9.0 by restricting these global endpoints to administrators and introducing a scoped endpoint for regular users.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-04-01: patched: First released in v0.9.0
- 2026-05-10: advisory: GitHub Advisory published
- 2026-05-14: disclosed: Advisory updated with CVE-2026-45399