Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260401-0",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260401-0 \u003e\n=======================================================================\n              title: Broken Access Control\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Open WebUI\n\u00a0vulnerable version: \u003cv0.8.11\n\u00a0 \u00a0 \u00a0 fixed version: v0.8.11\n         CVE number: CVE-2026-34222\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://openwebui.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-02-06\n                 by: Timo M\u00fcller (Office Munich)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The self-hosted AI interface.\nOpen WebUI is the platform for running AI on your own terms.\nConnect to any model\u2014local or cloud. Extend with Python.\nShare what you build with 331K others. 270 million downloads and growing.\"\n\nSource:https://openwebui.com/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Broken Access Control in Tool Valves (CVE-2026-34222)\nOpen WebUI supports function calling through \"Tools\". Function calling allows\nan LLM to reliably connect to external tools and interact with external APIs.\nExemplary use-cases include connecting to an internal knowledge base,\nretrieving emails from an exchange server, or retrieving order data from a\nshop backend.\n\nThese interactions often require the LLM to authenticate against backend\nservices using API keys specifically created for a technical (Open WebUI)\nuser.\n\nTo simplify configuration and secret handling, Open WebUI implements\n\"Valves\" and \"UserValves\" that allow users and administrators to input\ndynamic details like API keys or configuration options.\n\nValves have the following distinction:\n* Valves: Configurable by admins only.\n* UserValves: Configurable by any user.\n\nThe Tool Valves endpoint does not properly restrict read access to the\nvalve. This allows a low privileged user to access all data contained\nwithin the valve. In the worst case, this gives a low privileged\n\"Member\" user access to sensitive Tool data, such as API keys for\nthird-party systems.\n\n\nProof of concept:\n-----------------\n1) Broken Access Control in Tool Valves (CVE-2026-34222)\nThe following steps can be performed to reproduce the vulnerability.\n\n1. An administrator creates an Open WebUI Tool with a configured Valve.\n   \u003c10_create_tool.png\u003e\n2. The administrator configures the API key within the Tool Valve.\n   \u003c20_valves.png\u003e\n3. A user with at least \"Member\" privileges logs into Open WebUI.\n\nThe following screenshot shows the user overview of the test instance:\n\u003c30_user_admin.png\u003e\n\nThe following screenshot illustrates that the \"lowpriv\" user\ndoesn\u0027t have access to the tool:\n\u003c35_lowpriv.png\u003e\n\n4. The \"lowpriv\" user uses their Authorization token to retrieve the\nAPI key from the Tool Valve.\n\nIn order to do so, the attacker needs to know the Tool ID. However, as\nthis ID is always the same for imported tools, and the tool IDs are\nconcatenated from the tool name, guessing tool IDs is trivial.\n\u003c50_get_valve.png\u003e\n\n\nAs seen in the following code snippet, the vulnerability is present because\nthe Tool Valves route does not check if the requesting user\nhas administrative permissions.\n\nCode \nsource:https://github.com/open-webui/open-webui/blob/2b26355002064228e9b671339f8f3fb9d1fafa73/backend/open_webui/routers/tools.py#L513-L531\n\n```\n@router.get(\"/id/{id}/valves\", response_model=Optional[dict])\nasync def get_tools_valves_by_id(\n    id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)\n):\n    tools = Tools.get_tool_by_id(id, db=db)\n    if tools:\n        try:\n            valves = Tools.get_tool_valves_by_id(id, db=db)\n            return valves\n[...]\n)\n```\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* v0.7.2\n\nAll versions below the fixed version v0.8.11 are affected.\n\nVendor contact timeline:\n------------------------\n2026-02-11: Contacting vendor through the Open WebUI GitHub security\n            advisories page (github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m)\n2026-02-11: GitHub security advisory was closed by the maintainer with the\n            reasoning \"Tools perm should NOT be given to an untrusted party.\"\n2026-02-11: Closure of the advisory was contested by submitting additional proof\n2026-02-18: Additional reminder to the vendor that we will disclose this issue.\n2026-03-18: Additional reminder to the vendor that we will disclose this issue.\n2026-03-24: Vendor re-evaluates the submitted advisory, requests additional details,\n            and requests a validation of this issue on the development branch.\n2026-03-24: Provided the additional details and confirmed that the issue is patched\n            on the development branch.\n2026-03-24: Vendor re-opens and confirms the submitted  advisory.\n2026-03-27: Vendor confirms the CVSS score and requests a CVE through GitHub.\n2026-03-27: GitHub has issued CVE-2026-34222 for this vulnerability.\n2026-04-01: Vendor advisory published, SEC Consult release of advisory as well.\n\n\nSolution:\n---------\nThe vendor provides a patched version v0.8.11 which can be downloaded from their website:\nhttps://github.com/open-webui/open-webui/releases\n\nFix commit:https://github.com/open-webui/open-webui/commit/f949d17db1e62e0b79aecbbcbcabe3d57d8d4af6\n\nThe vendor has also published the security report / advisory here:\nhttps://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Timo M\u00fcller / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:20Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/4"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://github.com/open-webui/open-webui/blob/2b26355002064228e9b671339f8f3fb9d1fafa73/backend/open_webui/routers/tools.py#L513-L531"
        },
        {
          "url": "https://github.com/open-webui/open-webui/commit/f949d17db1e62e0b79aecbbcbcabe3d57d8d4af6"
        },
        {
          "url": "https://github.com/open-webui/open-webui/releases"
        },
        {
          "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://openwebui.com"
        },
        {
          "url": "https://openwebui.com/"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260401-0 :: Broken Access Control in Open WebUI",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34222",
              "type": "related"
            },
            {
              "destId": "GHSA-7429-HXCV-268M",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0273",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/4",
            "automated": true,
            "contentSha256": "b2be6ddec114650ae4b098be41d0e6356384de00fddf1cb618a6da830ebcf4aa",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-01T10:54:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0273"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T13:49:20Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0273"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}