Open WebUI’s /api/generate, /api/embed, /api/embeddings, and /api/show endpoints accepted any user‑supplied model name without verifying that the caller had permission to use that model. As a result, any authenticated, non‑pending user could execute requests against any Ollama model, potentially accessing or processing data that should be restricted. This is an access‑control bypass and the weakness is identified as CWE‑862.

Vulnerable configurations are deployments of Open WebUI prior to version 0.9.0, which is the self‑hosted artificial intelligence platform from the open-webui project. The issue applies to all builds of the software that do not incorporate the 0.9.0 fix, and it affects every user who can authenticate to the web UI but does not have administrative approval for specific models.

The severity rating of 5.4 on the CVSS vector places the issue in the medium range. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that the attacker obtains a valid authenticated session; no additional privileges are needed. Because the endpoints are reachable over HTTP/HTTPS, the threat is practical for anyone with network access to the host. In the absence of evidence of active exploitation, the risk remains medium but should be mitigated promptly.