The Open WebUI platform contains an access‑control flaw in its arena task endpoints. When an authenticated user who has read permission on an arena wrapper model invokes a task endpoint such as /api/v1/tasks/moa/completions, the system bypasses the final sub‑model authorization. This allows the user to access and interact with the underlying model that should be restricted. The weakness is a Missing Access Control (CWE-862).

This vulnerability affects the open-webui platform from version 0.8.12 up to but not including 0.10.0. Users running any release in that range are at risk.

The CVSS score of 5.4 indicates a medium severity vulnerability. The EPSS score of <1% shows a very low overall exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an authenticated session carrying read access to an arena wrapper model, making the attack path simple and straightforward for legitimate users with insufficient privileges. The bypass on the task routes removes a critical secondary check, effectively escalating privileges within the model layer.