Open WebUI, a self‑hosted AI platform, allows authenticated users to edit images by POSTing to /api/v1/images/edit. From versions 0.8.11 through just before 0.10.0, this endpoint only required a verified account and did not honor the global image‑edit switch or per‑user image‑generation permission settings. This is a missing authorization flaw (CWE‑862) and an improper access control weakness (CWE‑863). As a result, a non‑admin user could trigger server‑side image editing using credentials that an administrator had configured for a third‑party provider, effectively bypassing access controls and performing privileged image‑generation operations on the host.

The affected product is Open WebUI (open‑webui:open‑webui). All releases from 0.8.11 up to, but not including, version 0.10.0 are impacted.

The CVSS score of 4.3 indicates medium severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is below 1%, reflecting a very low exploitation probability. Exploitation would require an attacker to possess a verified account and to send a POST request to /api/v1/images/edit, leveraging existing administrator‑configured provider credentials. Updating to version 0.10.0 removes the bypass and eliminates the vulnerability.