Any authenticated user can steal another user's session token via script embedded in a DOCX preview

Any authenticated user can steal another user's session token via script embedded in a DOCX preview

Summary

Any authenticated user who can upload a DOCX attachment can embed active content in it that runs in the browser of anyone who previews the file, in the Open WebUI page origin. The preview renders a document-supplied HTML part and keeps document-supplied link targets without restriction, so embedded script reads the viewer's session token from local storage. When the viewer is an administrator, replaying that token grants full administrative control of the instance with no password.

Preconditions

• An approved account (role user or higher) able to upload DOCX attachments. New sign-ups start as pending by default (DEFAULT_USER_ROLE=pending) and cannot upload until an administrator approves them.
• The victim must open the shared chat, open the attachment and switch to the Preview view (one user interaction).
• No non-default configuration is required. The behaviour is present out of the box on affected versions.

Impact

The embedded script executes in the Open WebUI origin in the viewer's authenticated session and can read the session token. A stolen administrator token replays directly against the API without a password, giving the attacker the full administrator capability set (enumerating all users, changing roles, reading all chats and documents, creating API keys, changing instance settings). A low-privileged attacker thereby escalates to full instance control through one previewed document. Instances where DOCX preview is never used by higher-privileged users are not affected in practice.

Fix