CVE-2026-85704
LowCVSS 3.7Summary
In the ramon-victor freegpt-webui project up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc, there is a race condition vulnerability in the getJailbreak function of the file server/config.py in the Jailbreak Mode component. The attack can be launched remotely but requires a high level of complexity and is assessed as difficult to exploit. The exploit has been released. The product uses a rolling release model, so version details are not available. This vulnerability only affects products that are no longer supported by the maintainer.
Risk Assessment
The risk is limited because the vulnerability only affects unsupported versions and is difficult to exploit. However, the public exploit could be used in attacks against systems still using this software.
Recommendation
Discontinue use of this software as it is no longer supported. If necessary, apply temporary measures to restrict access to the Jailbreak Mode functionality.
Other vulnerabilities in freegpt-webui
See all- CVE-2026-85703Medium
A flaw in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc affects the getJailbreak function in server/backend.py of the Jailbreak Mode component. Manipulation can lead to resource allocation. The attack can be executed remotely. The exploit has been published and may be used. This product is no longer supported by the maintainer.
- CVE-2026-85702High
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. It affects the _conversation function in server/backend.py of the Backend Conversation API. Manipulation of the model argument leads to missing authentication. The attack can be launched remotely. The exploit has been publicly disclosed. This product operates on a rolling release basis, so no version details are available. This vulnerability only affects products no longer supported by the maintainer.
- CVE-2026-85701Medium
A vulnerability in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc affects the ChatCompletion.create function in g4f/__init__.py of the Authentication Check component. Manipulation leads to missing authentication. The attack may be performed remotely. The exploit has been disclosed publicly and may be used. This product is no longer supported by the maintainer.
Original NVD description (English source)
A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. This vulnerability only affects products that are no longer supported by the maintainer.