The flaw in the Open WebUI platform lies in the arena task endpoints that bypass the model access checks. When an authenticated non-admin user with read access to an arena wrapper model invokes a task endpoint such as /api/v1/tasks/moa/completions, the platform incorrectly resolves the underlying model after the wrapper access check. In this direct path the fallback resolution skips the final sub-model authorization and permits the user to interact with a model they should not be permitted to use. This results in unauthorized manipulation of a protected AI model. The flaw is a case of Missing Access Control (CWE-862).

This issue affects the open-webui platform from version .x but not including, 0.10.0. Users running any release in that range are vulnerable and should upgrade to 0 or later.

The CVSS score of 5.4 indicates a medium severity. The EPSS score of <1% indicates a very low but non-zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented public exploitation at this time. Nonetheless, the attack requires only an authenticated session with read access by simply invoking the exposed API endpoints. The presence of the bypass on the task routes removes the protective secondary model check, dramatically widening the potential impact.