The vulnerability arises from the use of Pydantic's ConfigDict with extra='allow' in Open WebUI's FolderForm before version 0.9.0. This configuration permits arbitrary fields to pass through validation and be persisted after serialization. Because the FolderModel declares a user_id field, an attacker can supply a user_id in the POST body that overrides the server‑assigned value. The result is that folders can be created under any user account, enabling unauthorized access to that user’s data and potential data disclosure or confusion. This flaw is a classic authorization bypass represented by CWE‑862.

Open WebUI – the self‑hosted AI platform – affected by all releases before 0.9.0. The fix was applied in version 0.9.0 and later, eliminating the uncontrolled mass assignment of the user_id field. Users running earlier versions that expose the folder creation endpoint are vulnerable.

The likely attack vector is inferred to be a remote attacker able to send a crafted POST request to the folder creation endpoint; this inference is not directly stated in the input. The CVSS score of 5.0 rates the weakness as medium severity, reflecting that it does not allow arbitrary code execution but does permit a privilege escalation path. No EPSS data is available and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires the ability to send a crafted POST request to the folder creation endpoint; since the application is typically accessed over a network, a remote attacker who can reach the service and potentially gain an authenticated session can exploit it. Once the user_id can be injected, the attacker can create or modify folders under any account, which may lead to inadvertent data exposure or account confusion.