CVE-2026-85702
HighCVSS 7.3Summary
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. It affects the _conversation function in server/backend.py of the Backend Conversation API. Manipulation of the model argument leads to missing authentication. The attack can be launched remotely. The exploit has been publicly disclosed. This product operates on a rolling release basis, so no version details are available. This vulnerability only affects products no longer supported by the maintainer.
Risk Assessment
An attacker can remotely exploit the missing authentication to gain unauthorized access to conversation functions, potentially leading to data confidentiality breaches or unauthorized resource usage. Since the exploit is public, the risk is high, but only for unsupported versions.
Recommendation
Since the product is no longer supported, discontinue its use and migrate to an actively maintained solution. If necessary, restrict network access and monitor logs.
Other vulnerabilities in freegpt-webui
See all- CVE-2026-85704Low
In the ramon-victor freegpt-webui project up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc, there is a race condition vulnerability in the getJailbreak function of the file server/config.py in the Jailbreak Mode component. The attack can be launched remotely but requires a high level of complexity and is assessed as difficult to exploit. The exploit has been released. The product uses a rolling release model, so version details are not available. This vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2026-85703Medium
A flaw in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc affects the getJailbreak function in server/backend.py of the Jailbreak Mode component. Manipulation can lead to resource allocation. The attack can be executed remotely. The exploit has been published and may be used. This product is no longer supported by the maintainer.
- CVE-2026-85701Medium
A vulnerability in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc affects the ChatCompletion.create function in g4f/__init__.py of the Authentication Check component. Manipulation leads to missing authentication. The attack may be performed remotely. The exploit has been disclosed publicly and may be used. This product is no longer supported by the maintainer.
Original NVD description (English source)
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This vulnerability only affects products that are no longer supported by the maintainer.