The vulnerability in Open WebUI’s chat completion API allows an authenticated user to supply a tool’s identifier or server details so that any server tool can be invoked without permission checks. Because the server’s own authentication token is used when executing the tool, the tool runs with elevated privileges, effectively enabling the attacker to perform any action that the server is allowed to execute, potentially compromising data or system integrity. This flaw is disclosed as CWE‑862.

Open WebUI versions before 0.8.6 are affected.

The CVSS base score of 7.1 reflects moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, through the chat completion endpoint, and requires that the attacker have a valid user authentication token to invoke the API. An attacker with such a token can add arbitrary tool identifiers or server URLs to the request, bypassing the intended restriction mechanism and executing arbitrary server‑side code.