Executive brief
Open WebUI is a user interface for interacting with large language models. A security flaw allowed regular users to bypass administrative restrictions on image editing. This could lead to unauthorized use of expensive third-party AI services, resulting in unexpected financial costs for the organization.
Technical details
The 'POST /api/v1/images/edit' endpoint in Open WebUI failed to implement authorization checks beyond verifying that a user was logged in. While other image-related routes enforced the 'ENABLE_IMAGE_EDIT' global toggle and 'features.image_generation' per-user permissions, this specific route relied solely on 'get_verified_user'. An authenticated non-admin attacker could exploit this to send image-editing requests to configured providers (OpenAI, Gemini, or ComfyUI) using the administrator's API keys. This bypasses intended access controls and can lead to billable resource consumption. The issue is fixed in version 0.10.0.
Affected products
- Open WebUI Open WebUI >= 0.8.11, < 0.10.0
Timeline
- 2026-06-29: disclosed: Initial disclosure on GitHub
- 2026-07-09: advisory: NVD publication date
- 2026-07-24: advisory: GitHub Advisory published
- 2026-07-24: patched: Fix released in v0.10.0