Open WebUI allows any authenticated user to invoke the /api/chat/completions endpoint with an arbitrary Chat ID belonging to another user, thereby continuing that user's conversation without proper authorization. The vulnerability is a broken access control mechanism (CWE‑639). An attacker could read or write messages to the target conversation, potentially exposing sensitive content. The impact is a confidentiality and integrity breach of chat data; it does not permit code execution or modification of system configuration.

The flaw exists in all self‑hosted Open WebUI releases prior to version 0.9.0. Any deployment of open‑webui:open‑webui that has not applied the 0.9.0 update is vulnerable. The affected systems are the Open WebUI application, which is typically installed on a web server and accessed via HTTP(S).

The CVSS score of 7.1 classifies the vulnerability as High. Because the EPSS score is not available, the current probability of exploitation is uncertain, but the fact that it is not listed in KEV indicates it has not yet been widely exploited. Based on the description, the attack vector requires the attacker to possess any valid authenticated API key. Once authenticated, the attacker can immediately access any other user’s chat data by specifying the target chat ID, without further authorization checks.