https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T11:45:35.880712+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-44555 CVE-2026-44555 — Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining 2026-10-18T11:45:35.882403+00:00

Affected: open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via base_model_id: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model. Additionally, the model creation and import endpoints accept arbitrary base_model_id values without checking that the caller has access to that base model. Combined, this allows any user with the default model creation permission to create a model that chains to a restricted base model — and then invoke it, causing the server to dispatch the request to the restricted base model using the admin-configured API key. This vulnerability is fixed in 0.9.0.

 https://cve.radiocsirt.org/vuln/ghsa-9vvh-qmjx-p4q8 GHSA-9vvh-qmjx-p4q8 — Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining 2026-10-18T11:45:35.882501+00:00

Affected: PyPI: open-webui

# Base Model Routing Bypasses Access Control via Model Chaining

## Affected Component

Model chaining via `base_model_id`: - `backend/open_webui/routers/models.py` (lines 170-214, `create_new_model`) - `backend/open_webui/routers/models.py` (lines 254-308, `import_models`) - `backend/open_webui/main.py` (lines 1696-1711, base model resolution in chat completion) - `backend/open_webui/routers/openai.py` (lines 1032-1037, base model payload rewrite) - `backend/open_webui/routers/ollama.py` (lines 1086-1090, base model payload rewrite) - `backend/open_webui/utils/models.py` (line 380, `check_model_access` — checks user-facing model only)

## Affected Versions

Current main branch (commit `6fdd19bf1`) and likely all versions with the model chaining (`base_model_id`) feature.

## Description

Open WebUI supports model composition via `base_model_id`: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model.

Additionally, the model creation and import endpoints accept arbitrary `base_model_id` values without checking that the caller has access to that base model. Combined, this allows any user with the default model creation permission to create a model that chains to a restricted base model — and then…