Affected: open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, GET /api/v1/memories/ef is accessible without authentication and executes request.app.state.EMBEDDING_FUNCTION(...). This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used. This vulnerability is fixed in 0.8.0.

Affected: PyPI: open-webui

### Summary GET `/api/v1/memories/ef` is accessible without authentication and executes `request.app.state.EMBEDDING_FUNCTION(...)`. This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used. Code reference: `backend/open_webui/routers/memories.py` (@router.get("/ef") -> calls `request.app.state.EMBEDDING_FUNCTION("hello world"))`.

### Details GET `/api/v1/memories/ef` is reachable without authentication and triggers request.app.state.EMBEDDING_FUNCTION("hello world"). This crosses an intended security boundary by allowing unauthenticated users to invoke potentially expensive embedding computation and/or paid upstream embedding APIs.

### PoC 1. Start Open WebUI in default configuration (no special env hardening; default ENABLE_MEMORIES is true). 2. From an unauthenticated client (no cookies/Authorization header), call: curl -i http://\<host\>:\<port\>/api/v1/memories/ef 3. Observe the server performs embedding generation and returns a response like: - HTTP 200 with JSON containing the result.

How it can be abused / attacker actions:

- Send repeated requests to `/api/v1/memories/ef` to: - consume CPU/GPU resources (DoS) - generate sustained outbound usage to embedding providers if configured (cost + rate-limit exhaustion) - degrade latency/availability for legitimate users ### Impact If embeddings are configured to use paid/remote providers (OpenAI/Azure/etc), an attacker c…