CVE-2026-59225
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In Open WebUI from version 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can bypass access control to a restricted underlying model via task endpoints like /api/v1/tasks/moa/completions. The normal chat route checks the arena model before dispatching, while the task route calls generate_chat_completion() directly with bypass_filter=True, skipping the submodel's access check.
Risk Assessment
The organization is at risk of unauthorized access to restricted AI models by users with limited privileges, potentially leading to sensitive data leakage or security policy violations.
Recommendation
Immediately upgrade Open WebUI to version 0.10.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Open WebUI
See all- CVE-2026-45350High
In Open WebUI prior to version 0.8.6, there is a vulnerability in the chat completion API that allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access.
- CVE-2026-45338High
In Open WebUI prior to version 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the _process_picture_url() function, allowing an attacker to force the server to make HTTP requests to internal resources.
- CVE-2026-45315High
Open WebUI prior to version 0.9.3 has a vulnerability that allows audio files with HTML extensions to be uploaded, potentially leading to the execution of malicious code in users' browsers. A user with the appropriate permissions can trick others into opening a malicious link.
- CVE-2026-45303High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.5 allowed for script injection and execution through the HTML rendering view. The chat content was embedded in an iFrame with sandbox restrictions that were largely ineffective.
- CVE-2026-45301High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.3.16 had a missing permission check in files related to API endpoints. This allowed any authenticated user to list, access, and delete every file uploaded by other users.
- CVE-2026-44570High
In Open WebUI prior to version 0.6.19, there were inconsistencies in authorization controls surrounding the memories API, allowing standard users to delete, restore, and view the contents of other users' memories.
- CVE-2026-44569High
In Open WebUI prior to version 0.6.19, there is an IDOR vulnerability in the channels message management system that allows authenticated users to modify or delete any message within channels they have access to. The issue arises from a lack of message ownership validation in the message update and delete endpoints.
- CVE-2026-44567High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.1.124 did not properly validate whether a user has an authorized role. By default, when new user sign-ups are enabled, the user role is set to 'pending', requiring administrator intervention to assign the appropriate role.
- CVE-2026-44566High
Open WebUI is an artificial intelligence platform that prior to version 0.1.124 did not validate or sanitize file names uploaded by users. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended upload directory.
- CVE-2026-44565High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.10 did not validate or sanitize file names when uploading audio files. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended uploads directory.
Original NVD description (English source)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected submodel's access check. This issue is fixed in version 0.10.0.