Open WebUI allows a user to modify another user's model even when the model is marked private, due to a missing authorization check in the update function. An attacker who can authenticate to the platform can change the configuration or replace the model file, potentially injecting malicious content that will be used for inference. The flaw is an example of improper authorization (CWE-285) and grants unauthorized privilege escalation within the application.

The vulnerability exists in all self‑hosted Open WebUI deployments before version 0.5.7. Any user who interacts with the Open WebUI web interface or API before that patch level is at risk.

The CVSS score of 6.5 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS value is available, so the likelihood of exploitation cannot be quantified, but the attack path is straightforward: an authenticated user can simply issue a model‑update request. Once exploited, the attacker can alter model parameters or replace the model file, giving them control over the model’s behavior. Because no additional prerequisites beyond valid credentials are required, the risk profile is moderate to high depending on the trust level of users on the server.