Open WebUI fails to confirm that a user has an authorized role before granting access. By default, newly registered users are assigned a pending status, requiring an administrator to manually change the role to user or admin. Because this step is not enforced by the API, an attacker who registers a new account can immediately gain access to the application with the pending role, potentially exposing sensitive data or enabling further exploitation.

The flaw affects installations of open-webui:open-webui that are running versions before 0.1.124. The vulnerability is tied to the user role validation logic shipped with those releases.

The CVSS score of 7.3 indicates a high severity level, while the EPSS score is unavailable. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by simply creating a new account when sign‑ups are enabled, and no special privileges are required. Once the pending user gains access, the attacker may perform any action permitted to that role, making the risk of unauthorized data disclosure or further compromise significant.