CyberRota Analysis
AI-GeneratedThe OAuth token exchange endpoint in Open WebUI versions 0.8.0 to 0.11.1 improperly issues sessions without enforcing role management, allowing users to bypass role restrictions and gain unauthorized access based on their existing roles. This vulnerability could lead to privilege escalation, compromising the integrity of user permissions within the platform. Organizations utilizing affected versions of Open WebUI should prioritize upgrading to version 0.11.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.