A logged-in non‑admin user can trigger an API request to /api/models, which exposes the system prompts set by administrators. This disclosure compromises the confidentiality of the application’s internal configuration and can reveal sensitive information about the AI models and their settings. The weakness is a classic information‑disclosure flaw, identified as CWE‑200.

The affected software is Open WebUI by open-webui, version 0.8.8 and earlier. Versions 0.8.9 and later contain the fix.

The CVSS score of 6.5 indicates a moderate severity. Exploitability requires a valid authenticated non‑admin session, so the attack vector is limited to users who have legitimate access to the system. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The risk is therefore medium, primarily affecting confidentiality and limited to users who can log in.