Open WebUI is a self‑hosted artificial intelligence platform that operates entirely offline. In versions before 0.9.6, its prompt‑version history API endpoints validate the prompt ID supplied in the URL but then use a caller‑supplied history ID without verifying that the history record belongs to that prompt. Consequently, any authenticated user who has control over a prompt and can determine or guess a victim’s prompt_history.id can read or delete that user's private prompt history. This is an IDOR vulnerability (CWE‑639) compounded by insufficient authorization controls (CWE‑284).

The flaw exists in the open‑webui:open‑webui product on all releases prior to version 0.9.6. Any self‑hosted installation running an older version is vulnerable.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated and have ownership of at least one prompt, then acquire a victim’s history ID (which can be guessed or enumerated via API). Once these prerequisites are satisfied, the attacker can issue requests to read or delete the victim’s prompt history by hitting the exposed endpoints. The likely attack vector is an authenticated API request over the network; this is inferred from the description of the affected endpoints.