Open WebUI EUVD-2026-97598

Requires a valid authenticated account on the Open WebUI instance (CVSS PR:L) and that the instance has one or more model provider backends - specifically Ollama and/or OpenAI-compatible connections - configured, including at least one that an administrator has disabled but whose API keys remain stored. The attacker triggers the flaw by passing an explicit backend index as a path segment or query parameter on the model listing routes. Limiting factors: exploitation is impossible without an account, so instances without self-service registration and with trusted users only face minimal realistic risk; impact is bounded to disclosure of version strings, connection enumeration, and the server-side use of stored API keys (keys are used in outbound requests, not necessarily returned in plaintext), with no integrity or availability impact.

This is a medium-severity information-disclosure issue (CVSS 4.0 base 5.3) best characterized as an IDOR/missing-authorization flaw (CWE-639), not a critical breach. The CVSS vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-reachable, low-complexity exploitation that REQUIRES an authenticated account (PR:L) and yields only low confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N). No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The key signals are consistent rather than conflicting: a low-privilege authenticated attacker can bypass intended authorization checks to reach backends an operator deliberately disabled, read version strings, and enumerate connections, and crucially trigger outbound requests that carry configured API keys. The real risk therefore hinges on the sensitivity of those keys and whether untrusted users hold accounts on the instance; on a locked-down single-admin deployment the practical risk is low, whereas on a multi-tenant or publicly-registerable instance it is a meaningful insider/low-privilege escalation of exposure. Overall this is a genuine but moderate-priority fix rather than an emergency: patch in routine cycles, prioritizing instances with self-service registration or shared/multi-user access.

An authenticated low-privilege user of an Open WebUI instance crafts requests to the Ollama or OpenAI-compatible model-listing routes, supplying an explicit backend index as a path segment or query parameter to target a provider backend the administrator had disabled. The server honors the index without an authorization check, issuing requests that carry the configured API keys and returning version strings and enumerable connection details back to the attacker. No public exploit code is referenced, but exploitation is trivial given a valid account and knowledge of the index parameter.