Listen to this Post
The vulnerability exists in the `/api/tasks/stop/` endpoint of Open-WebUI version 0.6.33. This API function is designed to cancel long-running LLM inference tasks. The flaw occurs because the endpoint directly accesses and acts upon a task using only a provided task identifier (task_id) without performing an authorization check to verify that the requesting user owns or is permitted to interact with that specific task. The application fails to validate if the authenticated user’s session or token has the rights to stop the task corresponding to the submitted ID. Consequently, an attacker who is a normal, authenticated user can craft a simple HTTP POST request containing the identifier of any active task in the system, even those initiated by other users or administrators. By sending this request to the vulnerable endpoint, the attacker can prematurely cancel arbitrary LLM response tasks, leading to a denial-of-service condition for other users by interrupting their queries without permission.
Platform: Open-WebUI
Version: v0.6.33
Vulnerability: Incorrect Access Control
Severity: Low
Date: Dec 5, 2025
Prediction: Patch expected Dec 19, 2025
What Undercode Say:
curl -s https://api.github.com/repos/open-webui/open-webui/releases/latest | grep tag_name
grep -r "/api/tasks/stop/" ./open-webui/src/
Example vulnerable code pattern
@app.post("/api/tasks/stop/")
def stop_task(task_id: str):
task = task_manager.get_task(task_id)
task.cancel() No user ownership check
return {"status": "cancelled"}
How Exploit:
curl -X POST 'http://target.com/api/tasks/stop/' -H 'Authorization: Bearer USER_TOKEN' -d '{"task_id":"TARGET_TASK_UUID"}'
Protection from this CVE:
Update to patched version (post v0.6.33).
Implement task ownership verification.
Add user permission checks.
Impact:
Task denial-of-service.
Disruption of LLM responses.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
