Open WebUI's legacy chat-completions service ignored the image_generation flag supplied by the client and did not re‑enforce the image_generation permission that is normally checked by the direct image routes and native function‑calling path. As a result, an authenticated user whose image-generation privilege had been revoked could still request the operator’s image provider via chat completions. This bypass allowed the user to consume API credits and provider quota, as well as to write image files to the operator’s storage, without exposing the provider credentials or other users’ data. The flaw is a classic example of missing access control (CWE‑862) and missing authorization checks (CWE‑863), leading to unauthorized use of system resources and potential cost escalation.

The vulnerability exists in Open WebUI versions 0.7.0 through 0.10.x; the fix was introduced in version 0.11.0. Any self‑hosted installation running from 0.7.0 up to, but not including, 011.0 is potentially impacted.

With a CVSS score of 4.3 the flaw is rated medium severity; the EPSS score is currently unavailable and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session and the presence of a user account whose image-generation permission has already been revoked. The attacker can generate images and accrue costs, but the attack vector is limited to legitimate accounts, not to unauthenticated or remote actors. The risk is therefore moderate, with a potential for significant unintended resource consumption if many users inadvertently retain revocations.