Improper Authorization in Open WebUI - #VU130237

Detailed vulnerability description

The vulnerability allows a remote attacker to access authenticated API functionality and disclose limited information, modify limited data, or affect availability.

The vulnerability exists due to improper authorization in authenticated API endpoints when handling requests with a valid JWT issued to a newly registered pending account. A remote attacker can sign up for an account and use the returned token to access endpoints intended for verified users to access authenticated API functionality and disclose limited information, modify limited data, or affect availability.

Only deployments with new sign-ups enabled are exposed to registration-based exploitation, and pending accounts are treated as authenticated users by the API despite client-side restrictions.

Remediation

Sources

• https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf
• https://github.com/open-webui/open-webui/blob/0399a69b73de9789c4221acedea70d528e1346c4/backend/utils/utils.py#L77-L97