CVE-2026-44555
HighSummary
Open WebUI prior to version 0.9.0 has a vulnerability that allows users with default model creation permissions to create chained models referencing restricted base models. Access verification for base models is not performed, enabling unauthorized access.
Risk Assessment
The organization may be exposed to unauthorized access to restricted AI models, potentially leading to data leaks or misuse of resources. Possible consequences include security breaches and loss of user trust.
Recommendation
It is recommended to update Open WebUI to version 0.9.0 or later to eliminate this vulnerability. Additionally, an audit of user permissions should be conducted to restrict access to model creation.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via base_model_id: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model. Additionally, the model creation and import endpoints accept arbitrary base_model_id values without checking that the caller has access to that base model. Combined, this allows any user with the default model creation permission to create a model that chains to a restricted base model — and then invoke it, causing the server to dispatch the request to the restricted base model using the admin-configured API key. This vulnerability is fixed in 0.9.0.