The vulnerability allows a non‑admin user who can create or own group channels to submit arbitrary access grants, including public wildcards, that are stored without filtering. This bypasses the platform’s admin‑controlled permission model. The flaw is a classic missing authorization weakness (CWE‑862), enabling unauthorized disclosure and potential abuse of channel data.

This flaw affects installations of the open‑webui self‑hosted AI platform before version 0‑9‑0. The affected code is the channel router, which omits the filter_allowed_access_grants check on create or update operations.

The issue has a CVSS base score of 5.4, indicating moderate impact. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires the ability to create or own a channel; an attacker with a user account can exploit the route to grant public access, potentially exposing sensitive content. Because the vulnerability does not require elevated privileges or remote exploitation of the server, the threat surface depends on the user base and channel management policies.