The vulnerability resides in the Open WebUI platform, an offline AI service. In versions before 0.9.5, sending a GET request to /api/v1/retrieval/ returns the live Retrieval Augmented Generation pipeline configuration to any HTTP client without needing a token or authentication header. The endpoint is protected by the usual get_admin_user logic only on neighboring routes, so the omission allows unauthenticated disclosure of internal configuration data. This represents a moderate severity disclosure of potentially sensitive system settings, which an attacker could leverage to understand the system internals or plan subsequent attacks. The weakness is identified as CWE‑306, an authentication bypass.

Affected systems are installations of Open WebUI version 0.9.4 and earlier. The vulnerability is confirmed in the open-webui product as distributed by the open-webui authors. The configuration endpoint remains accessible to anyone who can reach the deployment network point of entry, regardless of authentication enforcement on other endpoints.

The CVSS score of 5.3 indicates moderate impact. The EPSS score is 1%, and the vulnerability is not listed in CISA KEV, suggesting lower exploitation likelihood in the current threat landscape. However, because the attacker only needs to send an unauthenticated HTTP GET request, the attack vector is straightforward and can be executed without special credentials. If the service is exposed to the internet or an untrusted network segment, the risk of accidental disclosure is significant.