The flaw in Open WebUI versions 0.9.0 through the pre‑0.10.0 releases occurs when the execute_automation routine rehydrates automation owners without rechecking that those owners are still active or possess the required automation permissions. At the same time, the check_model_access logic only applies private‑model grants for the exact user role, meaning a deactivated pending user can still trigger scheduled automations that run private models. This authorization bypass enables the attacker to access private models and potentially leak sensitive data or consume resources they should not be able to use.

Any self‑hosted Open WebUI installation running a vulnerable version – specifically 0.9.0 up to but not including 0.10.0 – is affected. The fix was introduced in release 0.10.0, which added a re‑validation step for user status and model ACLs at the start of automation execution, preventing deactivated pending users from running automated tasks.

The CVSS score of 3.1 indicates low severity, and the EPSS score of <1% indicates a very low exploitation probability. The vulnerability is not listed in CISA KEV. An attacker would need to obtain or create a deactivated pending user that still retains automation permissions; once such an account exists, the automated process can be triggered, allowing the attacker to execute private models without proper authorization. The exploitation requirements are specific and not trivial, which contributes to the low risk rating.