Open-webui version prior to 0.3.33 contains a CORS misconfiguration combined with a session validation issue that allows arbitrary websites to make authenticated cross-site requests to the application. This vulnerability enables attackers with admin access to execute arbitrary code remotely on the open-webui instance. The application runs as root in its default Docker container setup, which can lead to complete container compromise. A fix is available in version 0.3.33.