https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-04T19:58:55.912167+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/bdu:2026-07197 bdu:2026-07197 2026-10-04T19:58:55.932326+00:00 bdu:2026-07197 https://db.gcve.eu/vuln/fkie_cve-2026-45395 fkie_cve-2026-45395 2026-10-04T19:58:55.932379+00:00

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint. This allows a user who has been explicitly denied tool management capabilities ( and who the administrator considers untrusted for code execution ) to replace a tool's server-side Python content and trigger execution, bypassing the intended workspace.tools security boundary. This vulnerability is fixed in 0.9.5.

 https://db.gcve.eu/vuln/ghsa-p4fx-23fq-jfg6 GHSA-p4fx-23fq-jfg6 — Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code E… 2026-10-04T19:58:55.932421+00:00

Affected: npm: open-webui

### Summary

The tool update endpoint (`POST /api/v1/tools/id/{id}/update`) is missing the `workspace.tools` permission check that is present on the tool create endpoint. This allows a user who has been explicitly **denied** tool management capabilities ( and who the administrator considers **untrusted** for code execution ) to replace a tool's server-side Python content and trigger execution, bypassing the intended `workspace.tools` security boundary.

Open WebUI's security policy correctly states that `workspace.tools` is the trust boundary for code execution: *"Granting a user the ability to create Tools is equivalent to giving them shell access to the server."* This vulnerability breaks that boundary. A `write` access grant on a single tool is sufficient to bypass `workspace.tools` entirely.

This is **not** a report about exec() being unsandboxed (that is acknowledged as intended behavior). This is a report about a **missing authorization check** that allows an untrusted user to reach the exec() sink that should be gated behind `workspace.tools`.

### Root Cause

The create and update endpoints for tools have **asymmetric authorization checks**. The create endpoint enforces the `workspace.tools` permission; the update endpoint does not.

#### Create endpoint, enforces `workspace.tools`

**File**: `backend/open_webui/routers/tools.py`, lines 326-345

```python @router.post('/create', response_model=Optional[ToolResponse]) async def create_new_tools( request: Request…