Prior to version 0.9.5, the FeedbackForm endpoint in Open WebUI accepted arbitrary data and performed a dictionary merge in a way that let an attacker include a user_id field in the request body, overriding the server‑derived value. This functionality of CWE‑915 permitted an authenticated user to create feedback entries that appeared to belong to any user, corrupting the Elo rating system and enabling identity spoofing.

The vulnerability affects Open WebUI, specifically versions earlier than 0.9.5, including the 0.9.2 release referenced in the advisory. The impact is limited to deployments that expose the /api/v1/evaluations/feedback endpoint to authenticated users.

The CVSS score of 5.4 indicates a medium severity vulnerability, and the EPSS score is not currently available. The vulnerability is not listed in the CISA KEV catalog. An attacker would need valid credentials to send a POST request to the feedback endpoint, making the attack remote but authenticated. The insecure merge order allows the attacker to set the user_id field, tampering with leaderboard data and enabling spoofed identities.