Executive brief
Open WebUI is a user interface for interacting with large language models. A vulnerability was found where scheduled tasks (automations) created by a user would continue to run even after that user's account was deactivated or their permissions were revoked. This could lead to unauthorized use of expensive AI model resources and API credits by accounts that should no longer have access.
Technical details
The vulnerability exists because the background scheduler in Open WebUI does not re-validate the owner's role or permissions when an automation task becomes due. Specifically, the 'execute_automation()' function rehydrates the user object but fails to check if the user still holds the 'user' or 'admin' role or the 'features.automations' permission. Additionally, 'check_model_access()' incorrectly applied private-model ACLs only to the specific 'user' role, allowing 'pending' (deactivated) roles to bypass these checks. An attacker with a previously active account could create an automation that continues to consume provider credentials and bypass model access controls after their account is deactivated. This is addressed in version 0.10.0 by adding explicit role and permission checks during execution.
Affected products
- Open WebUI open-webui >= 0.9.0, < 0.10.0
Timeline
- 2026-06-29: disclosed
- 2026-07-09: advisory: NVD publication
- 2026-07-24: patched: GitHub Advisory published/reviewed