The vulnerability allows a user who possesses the workspace.models_import permission to replace any existing model in the Open WebUI database. By sending a POST request to /api/v1/models/import with a model ID that matches an existing one, the attacker’s payload is merged over the current model data and written back to the database without any ownership or access grant validation. This effectively bypasses the system’s authorization checks for model mutation, permitting an attacker to alter or replace models arbitrarily.

The flaw exists in the open-webui open-webui application before version 0.9.0. Users running any pre‑0.9.0 release are affected. The issue is resolved in 0.9.0 and later releases.

The CVSS score is 6.5, indicating a medium severity vulnerability. No EPSS score is available, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely achieved via authenticated API access to the import endpoint; the vulnerability requires an attacker to have workspace.models_import permission. Once exploited, the attacker can overwrite any model, potentially compromising the integrity of the system and the correctness of AI responses. Given the scope of impact—affecting all users who rely on the overwritten model—organisations should treat this as a serious operational risk.