PT-2025-49046 · Unknown · Open-Webui

Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-63681

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions open-webui version 0.6.33

Description The software contains a flaw related to access control. The /api/tasks/stop/ API endpoint allows direct access and cancellation of tasks without verifying user ownership. This enables an attacker, even a normal user, to stop any LLM response task. The vulnerable parameter is not specified.

Recommendations Apply updates to address the access control issue in the /api/tasks/stop/ API endpoint.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-63681

GHSA-FRV8-GFFC-37PX

Affected Products

Open-Webui

References · 12

• 🔥 https://github.com/TOAST-Research/pocs/blob/main/openwebui/arbitirary_task_stop/report.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63681 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63681 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-frv8-gffc-37px · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/blob/46ae3f4f5d7d4d706041bdae4ad2d802e568712b/backend/open_webui/main.py#L1652 · Note
• https://reddit.com/r/VulnMatter/comments/1pevkbf/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1996695162903257467 · Twitter Post
• https://twitter.com/CVEnew/status/1996600336455274604 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1peus6e/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1peorgc/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://t.me/CVEtracker/38840 · Telegram Post