trace_74a04f459ce245b18ba17e1b86de70c6

Repository: open-webui/open-webui
Advisory: GHSA-7429-hxcv-268m
Open WebUI has Broken Access Control in Tool Valves

{
  "rubricVersion": "v1",
  "synopsis": "Authenticated low-privilege users can read admin-configured Tool Valve secrets because the Tool Valves read route lacks an administrative authorization check.",
  "sinkHints": [
    {
      "path": "backend/open_webui/routers/tools.py",
      "whyItMatters": "The advisory pinpoints the Tool Valves route in this file and states the read endpoint returns valve data without verifying that the requester is an admin."
    }
  ],
  "rubricDimensions": [
    {
      "key": "target-alignment",
      "label": "Target alignment",
      "weight": 30,
      "description": "The submission identifies the correct vulnerable subsystem, files, and sink-bearing path for the advisory."
    },
    {
      "key": "source-to-sink-reasoning",
      "label": "Source-to-sink reasoning",
      "weight": 30,
      "description": "The report demonstrates how attacker-controlled input can reach the vulnerable sink without hand-waving."
    },
    {
      "key": "impact-and-exploitability",
      "label": "Impact and exploitability",
      "weight": 20,
      "description": "The impact narrative is technically credible, grounded in code, and proportional to the evidence presented."
    },
    {
      "key": "evidence-quality",
      "label": "Evidence quality",
      "weight": 10,
      "description": "The report cites concrete files, code paths, or commands instead of relying on generic vulnerability language."
    },
    {
      "key": "overclaim-control",
      "label": "Overclaim control",
      "weight": 10,
      "description": "The submission avoids unsupported exploit chains, misclassified bug classes, or claims that contradict the answer key."
    }
  ],
  "answerKey": {
    "advisoryGhsaId": "GHSA-7429-hxcv-268m",
    "repoFullName": "open-webui/open-webui",
    "checkoutRef": "v0.8.11",
    "checkoutRefKind": "tag",
    "vulnerabilityClasses": [
      "broken access control",
      "information disclosure"
    ],
    "expectedComponents": [
      "Tool Valves endpoint",
      "tools router"
    ],
    "sinkPaths": [
      "backend/open_webui/routers/tools.py"
    ],
    "requiredEvidence": [
      "the GET Tool Valves route at /api/v1/tools/id/<tool_id>/valves is implemented in backend/open_webui/routers/tools.py",
      "the handler reads or returns Tool Valve data",
      "the route does not enforce an administrative permission check before disclosing valve contents",
      "a low-privileged authenticated user can use this endpoint to retrieve sensitive Tool Valve values such as API keys"
    ],
    "disallowedClaims": [
      "remote code execution",
      "unauthenticated access",
      "arbitrary file read",
      "database injection",
      "privilege escalation to administrator"
    ],
    "notes": [
      "The advisory explicitly cites backend/open_webui/routers/tools.py lines 513-531 as the vulnerable area and says the missing admin check is the root cause.",
      "Keep the report grounded on improper read authori