CyberRota Analysis
AI-GeneratedThe legacy chat-completions feature in Open WebUI versions 0.7.0 to 0.11.0 allows authenticated users, even those with revoked image-generation permissions, to access the configured image provider, potentially leading to unauthorized API credit usage and storage of generated files. This vulnerability could impact operators by incurring unexpected costs and resource consumption without compromising sensitive credentials or data. Organizations using affected versions should prioritize upgrading to 0.11.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied image_generation flag and did not re-check the features.image_generation permission that the direct image routes and native function-calling path enforce. An authenticated user whose image-generation permission had been revoked could still consume the operator's configured image provider through chat completions, spending API credits and provider quota and writing generated files to operator storage, without exposing provider credentials or other users' data. This issue is fixed in 0.11.0.