CVE-2026-59227: Open WebUI Image Edit Authorization Bypass (0.8.11–0.9.x)

Technical summary

CVE-2026-59227 affects Open WebUI versions 0.8.11 through 0.9.x. The POST /api/v1/images/edit endpoint failed to validate two security controls: (1) the global image-edit feature switch, and (2) per-user image-generation permissions. Authentication was enforced (verified account required), but authorization checks were absent. An authenticated attacker could bypass administrative policy controls and directly invoke image editing with server-managed provider credentials. The vulnerability stems from missing authorization logic (CWE-862: Missing Authorization, CWE-863: Incorrect Authorization) and is resolved in version 0.10.0 with proper permission enforcement.

Business impact

Organizations running Open WebUI face two primary risks: resource exhaustion and credential misuse. Authenticated users can trigger image editing workloads without admin consent, consuming compute resources and incurring costs if external AI providers are configured. Additionally, if administrators have integrated paid or rate-limited image editing services, non-admin users can exploit those integrations, potentially inflating usage and bills. The vulnerability does not expose credentials directly but allows their unauthorized use.

Affected systems

Open WebUI versions 0.8.11 through 0.9.x are vulnerable. Version 0.10.0 and later are patched. Self-hosted deployments are at risk; the vulnerability requires network access to the API endpoint and a valid user account on the target instance.

Exploitability

Exploitability is moderate. An attacker must possess a verified user account (low bar in many self-hosted environments where registration may be open or OIDC integration permits broad enrollment). No special tools or user interaction are required; a single HTTP POST request to /api/v1/images/edit with valid credentials bypasses authorization. The CVSS score of 4.3 reflects low-severity impact (availability/resource consumption rather than confidentiality or integrity breach) but straightforward attack mechanics.

Remediation

Upgrade Open WebUI to version 0.10.0 or later. This version enforces global image-edit feature flags and per-user permissions before processing image editing requests. Organizations unable to upgrade immediately should restrict network access to the /api/v1/images/edit endpoint using a reverse proxy or firewall, or disable image editing entirely until the patch is deployed.

Patch guidance

Verify the installed Open WebUI version via the admin panel or by inspecting version files in the deployment. Version 0.10.0 or later is required. If running a containerized deployment, rebuild or re-pull the image tagged with version 0.10.0+. Review release notes for any configuration changes or migration steps. Test in a non-production environment before rolling out to production.

Detection guidance

Monitor logs for POST requests to /api/v1/images/edit from non-admin user accounts, particularly if image editing is supposed to be globally disabled or restricted. Unexpected image-editing activity, especially at scale or during off-hours, may indicate exploitation. Check for anomalous API calls paired with unusual resource consumption (CPU, GPU, network bandwidth if external APIs are called). Correlate user account creation or privilege-grant events with image-editing attempts to identify potential attack patterns.

Why prioritize this

Although the CVSS score is moderate (4.3), organizations should prioritize this patch because: (1) it requires only a verified account and network access—no complex prerequisites; (2) resource exhaustion and credential abuse can create operational and financial impact in cloud-hosted provider integrations; (3) it represents a policy-enforcement gap that may violate internal access controls; (4) the fix is straightforward and poses low deployment risk. Prioritization should be higher for instances with external AI provider integrations, open user registration, or multi-tenant environments.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM severity) reflects: Attack Vector: Network (high availability), Access Complexity: Low (straightforward API call), Privileges Required: Low (any verified user), User Interaction: None, Scope: Unchanged, and Impact: Low Availability (resource consumption, not system downtime or data loss). The score is conservative because integrity and confidentiality are not directly compromised. However, real-world risk may be higher depending on deployment context (e.g., if external provider credentials are valuable or resource costs are significant).

Frequently asked questions