BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-05

Assigner: MITRE

Description

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-04

Last Modified

2025-12-05

Generated

2026-07-06

AI Q&A

2025-12-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-63681

Affected Vendors & Products

Vendor	Product	Version / Range
openwebui	open_webui	0.6.41

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-NVD-CWE-noinfo

Attack-Flow Graph

Executive Summary

The vulnerability in open-webui v0.6.33 is an Incorrect Access Control issue where the API endpoint /api/tasks/stop/ allows any normal user to stop arbitrary LLM response tasks without verifying if the user owns those tasks.

Impact Analysis

This vulnerability allows an attacker with normal user privileges to cancel tasks initiated by other users, potentially disrupting service or interfering with legitimate operations.

Hi! I’m here to help you understand CVE-2025-63681. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70