Open WebUI CVE-2026-109293

Exploitation requires (1) an authenticated non-admin Open WebUI account, (2) that account holding the tool export permission, and (3) one or more tools shared with the user in read-only mode. Given those, the attacker simply calls GET /api/v1/tools/export, which improperly returns the complete Python source of the read-only shared tools rather than restricting to owned/editable tools, disclosing any API keys and credentials embedded in that source. Limiting factors: valid authentication is needed (PR:L), the specific tool export permission must have been granted, and there must be read-only shared tools present; the impact magnitude further depends on whether the shared tool code actually contains secrets. Affected deployments are Open WebUI 0.11.0 through 0.11.3; 0.11.4 fixes it.

This is a genuine but bounded issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 7.1 base score indicate network-reachable, low-complexity exploitation requiring only low-privilege authentication and no user interaction, with high confidentiality impact (VC:H) and no integrity or availability impact - consistent with the CWE-200 information-disclosure classification. However, the description adds an important qualifier the CVSS vector does not fully capture: exploitation requires an authenticated non-admin account that has been granted the tool export permission AND tools that have been shared with that user read-only. This is more restrictive than a flat PR:L implies, pushing real-world risk below what the score alone suggests. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation - no public exploit identified at time of analysis. There is no SSVC decision data supplied. Net: a credible insider/least-privilege-escalation confidentiality risk whose severity is driven by what the leaked tool source contains (embedded API keys/credentials), but the authentication and permission preconditions make it targeted rather than mass-exploitable.

A non-admin user who has been granted tool export permission and has read-only shared tools in their Open WebUI workspace sends a GET request to /api/v1/tools/export. Instead of being limited to tools they own, the endpoint returns the full Python source of the read-only shared tools, exposing any API keys or credentials embedded in that code, which the attacker can then reuse against the upstream services. No public exploit code is identified, but the attack is trivial (a single authenticated HTTP request) for anyone already holding the required account and permission.