The /api/v1/utils/code/execute endpoint of Open WebUI runs arbitrary Python code through Jupyter for any verified user even when the administrator has disabled the feature by setting ENABLE_CODE_EXECUTION to false. This flaw allows attackers to execute malicious code on the host, potentially gaining full control of the system. The vulnerability is an example of a restricted function bypass (CWE-863).

Open WebUI built by open-webui, specifically releases prior to version 0.8.12. Users of any earlier release that have granted verified user status are susceptible, regardless of the ENABLE_CODE_EXECUTION setting.

The CVSS score of 8.8 indicates high severity, and although a current EPSS score is not available, the risk remains significant for any verified user with API access. The flaw is not listed in CISA’s KEV catalog, but the attack vector is an authenticated API request by a legitimate user. Once the administrator attempts to disable code execution, the bypass remains active, giving attackers an unmitigated path to compromise the host.