Executive brief
Open WebUI is a user interface for interacting with large language models. A flaw in its chat system allows users who have been specifically restricted from generating images to bypass those restrictions. This could lead to unauthorized use of expensive image-generation credits and unexpected storage consumption on the server.
Technical details
A missing authorization check exists in the Open WebUI chat-completions endpoint. While direct image routes and native function-calling paths correctly enforce permissions, the legacy chat pipeline (active by default in versions prior to 0.10.0) trusts a client-supplied 'features' flag without server-side verification. An authenticated attacker with revoked image-generation permissions can trigger the image handler by manually setting the feature flag in a chat request. This allows the attacker to consume configured image provider quotas and write files to the server's storage. The issue is fixed in version 0.11.0 by ensuring the legacy chat block re-checks permissions against the caller's identity.
Affected products
- Open WebUI Open WebUI >= 0.7.0, < 0.11.0
Timeline
- 2026-08-02: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched: Fixed in version 0.11.0