Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex

Description

The tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint.

Recommendation

Update the open-webui package to the latest compatible version. Followings are version details:

Affected version(s): < 0.9.5
Patched version(s): 0.9.5

References

GHSA-p4fx-23fq-jfg6
CVE-2026-45395
CWE-269
CWE-862
CAPEC-310
OWASP 2021-A1
OWASP 2021-A4
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex and gives you actionable findings to investigate.

Start a free scan

Related Issues

@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck - CVE-2026-39397
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events - CVE-2025-64496
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts - CVE-2026-32106
open-webui Vulnerable to Stored XSS via Model Description - CVE-2026-44721

Update Cheat Sheet for Developers

10 Secure Coding Best Practices to Follow in Every Project

How to Secure your NodeJs Express Javascript Application - part 2

See something that needs correcting? Let us knowUpdated May 15, 2026