CyberRota Analysis
AI-GeneratedThe Open WebUI platform versions prior to 0.10.0 are vulnerable due to insufficient access controls on the image editing API, allowing non-admin users to perform server-side image editing using administrator credentials. This could lead to unauthorized modifications of images, potentially compromising sensitive data or misusing resources. Organizations using affected versions should prioritize upgrading to version 0.10.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and did not enforce the global image-edit switch or the per-user image-generation permission, allowing a non-admin user to invoke server-side image editing with administrator-configured provider credentials. This issue is fixed in version 0.10.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)