AI Threat Alert
CVE-2025-63681 is a broken object-level authorization flaw in Open-WebUI v0.6.33 that lets any authenticated user cancel any other user's running LLM inference task—no privilege escalation required. While CVSS is low and there is no data exposure, in multi-user or enterprise deployments a single compromised or malicious account can silently kill production inference workflows on demand. Upgrade when a patch ships; interim mitigation is restricting /api/tasks/stop/ to admin roles at the reverse proxy layer.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| open-webui | pip | <= 0.6.33 | No patch |
Do you use open-webui? You're affected.
Severity & Risk
Recommended Action
- 1. Patch: No official fix released at CVE publication—monitor open-webui GitHub releases and apply promptly when available. 2. Workaround: Add reverse proxy rule (nginx/Caddy) to block or restrict POST /api/tasks/stop/ to admin session tokens only. 3. Detection: Correlate /api/tasks/stop/ API calls with task ownership logs—alert when the calling user_id does not match the task creator user_id. 4. Network control: If Open-WebUI is internal tooling, ensure /api/ endpoints are not externally reachable. 5. Access hygiene: Audit and prune Open-WebUI accounts—remove dormant or shared credentials that could be abused.
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
Exploitation Scenario
A disgruntled employee with a standard Open-WebUI account targets a colleague running a time-sensitive 45-minute LLM document analysis job. After observing the task initiation in the shared UI, the attacker calls POST /api/tasks/stop/{task_id} using their own valid session cookie—no elevated privileges, no special tooling, just curl. The task terminates silently with no attribution in the UI. The attacker repeats this pattern against any user's active jobs, creating sustained service degradation that appears as system instability rather than targeted interference. No native audit trail ties the stop event to the attacker's identity.