The Open WebUI platform performs privilege checks on tool operations to protect its server‑side Python code. Prior to version 0.9.5, the tool‑update endpoint lacked the workspace.tools permission check that the tool‑create endpoint uses. As a result an attacker who has been explicitly denied tool‑management rights can replace the Python source of any hosted tool and execute arbitrary code under the WebUI process user. This flaw is a classic case of improper privilege management (CWE‑269) and missing authorization (CWE‑862). The immediate consequence is that an untrusted user can gain code‑execution authority on the host.

The affected product is Open WebUI, a self‑hosted artificial‑intelligence platform. Versions before 0.9.5 are vulnerable; the issue was fixed in 0.9.5. Users running any release earlier than 0.9.5 should review their deployment.

The CVSS score of 7.2 indicates high severity, and although the EPSS score is not available, the flaw can be triggered by an authenticated user who knows a tool identifier. No exploit is currently listed in the CISA KEV catalog. An attacker can forge a POST request to /api/v1/tools/id/{id}/update with malicious Python payload, replacing the tool’s server code and achieving arbitrary code execution.