CVE-2026-45395 Details

A vulnerability in Open WebUI versions prior to 0.9.5 allows users with a 'write' access grant on tools to execute arbitrary server-side code as root. This issue arises because the tool update endpoint (POST /api/v1/tools/id/{id}/update) lacks the necessary 'workspace.tools' permission check, which is enforced on the tool creation endpoint. As a result, a user who has been denied tool management capabilities and is considered untrusted for code execution can bypass the security boundary, replace a tool's Python content, and trigger execution. The vulnerability is rooted in asymmetric authorization checks between the create and update endpoints for tools.

The vulnerability can be addressed by adding the 'workspace.tools' permission check to the tool update endpoint, ensuring it matches the authorization requirements of the create endpoint.