Most recent entries from all

EUVD-2026-319077

fkie_cve-2026-44555

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via base_model_id: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model. Additionally, the model creation and import endpoints accept arbitrary base_model_id values without checking that the caller has access to that base model. Combined, this allows any user with the default model creation permission to create a model that chains to a restricted base model — and then invoke it, causing the server to dispatch the request to the restricted base model using the admin-configured API key. This vulnerability is fixed in 0.9.0.

GHSA-9vvh-qmjx-p4q8 — Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Affected: PyPI: open-webui

# Base Model Routing Bypasses Access Control via Model Chaining

## Affected Component

Model chaining via `base_model_id`: - `backend/open_webui/routers/models.py` (lines 170-214, `create_new_model`) - `backend/open_webui/routers/models.py` (lines 254-308, `import_models`) - `backend/open_webui/main.py` (lines 1696-1711, base model resolution in chat completion) - `backend/open_webui/routers/openai.py` (lines 1032-1037, base model payload rewrite) - `backend/open_webui/routers/ollama.py` (lines 1086-1090, base model payload rewrite) - `backend/open_webui/utils/models.py` (line 380, `check_model_access` — checks user-facing model only)

## Affected Versions

Current main branch (commit `6fdd19bf1`) and likely all versions with the model chaining (`base_model_id`) feature.

## Description

Open WebUI supports model composition via `base_model_id`: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model.