This vulnerability arises from the /responses endpoint in Open WebUI's OpenAI router, which accepts any authenticated user and forwards requests straight to upstream LLM providers without model‑specific authorization checks. Consequently, an attacker who has legitimate access to the system can send a POST request to /api/openai/responses with any model ID, enabling unauthorized use of all models configured on the instance. The flaw reflects improper access control (CWE‑284) and a failure to enforce authorization (CWE‑862).

The affected product is Open WebUI, a self‑hosted AI platform. All implementations of open-webui:open-webui prior to version 0.9.0 are vulnerable. The issue is fixed in 0.9.0, so any deployment running an older release must be considered at risk.

The CVSS score of 7.1 indicates high severity. Because the problem is accessed via an authenticated session, the attack vector requires valid credentials but does not rely on network exploitation or user interaction beyond normal login. The EPSS score is not available, so an exact exploitation probability cannot be derived; however, the lack of access controls implies that any authenticated user can abuse the vulnerability. The vulnerability is not currently listed in CISA's KEV catalog, but the potential to misappropriate all configured models makes it a high‑impact risk, especially in environments where model usage is tightly controlled.