Open WebUI allowed administrators to lock down specific API endpoints for an API key, but the same key sent in an x‑api‑key header bypassed those restrictions. The key was authenticated, the model executed, and the full response was returned, granting the attacker unauthorised access to the /api/v1/messages endpoint. This weakness is an authorization bypass (CWE‑863) that can compromise the intended limitation of the platform.

All self‑hosted Open WebUI installations running a version earlier than 0.9.0 are vulnerable. Admins who have restricted API keys for the /api/v1/messages endpoint will find those restrictions ineffective when the key is provided via the x‑api‑key header.

The CVSS score of 6.5 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not been widely exploited publicly yet. The likely attack vector involves an authenticated user who can supply an x‑api‑key header; if the service is exposed to the internet, an external attacker could send such requests directly, but this is inferred from the description and not explicitly stated in the advisory.