Open WebUI versions prior to 0.9.5 can allow users with read access to a shared model to view the model's system prompt. This unintentionally exposes text that users may consider confidential, leading to an information disclosure vulnerability identified as CWE‑200. No exploitation of code or denial of service is possible; the impact is purely data leakage.

The product affected is Open WebUI from the vendor open‑webui. All releases before 0.9.5 are vulnerable; the fix is included in version 0.9.5 and later.

The CVSS score of 4.3 indicates a medium severity level. Exploitation requires that an attacker already has read permission to a shared model, so the attack vector is local to the platform's permission model. EPSS information is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been reported. Overall, the risk is moderate, primarily due to potential disclosure of sensitive prompt data.