Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2026-59225: Open WebUI lets non-admin users reach restricted model
CVE-2026-59225 · published 3 months ago
Summary
Versions of Open WebUI from 0.8.12 up to but not including 0.10.0 let a logged‑in user who is not an administrator bypass the normal checks and use a hidden AI model through certain task APIs. This could allow users to run tasks with higher privileges than intended. Upgrade to version 0.10.0 or later, or temporarily limit access to the affected task endpoints, to close the gap.
What to do
- Update timothy jaeryang baek open-webui to version 0.10.0.
- Update openwebui open_webui to version 0.10.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | open-webui | open-webui | >= 0.8.12, < 0.10.0 |
| – | openwebui | open_webui |
>= 0.8.12, < 0.10.0 cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
| pip | timothy jaeryang baek | open-webui |
>= 0.8.12, < 0.10.0 Fix: upgrade to 0.10.0
|
Original advisory text
Open WebUI: Arena task endpoints can bypass underlying model access controls
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected submodel's access check. This issue is fixed in version 0.10.0.
References
- https://github.com/open-webui/open-webui/releases/tag/v0.10.0 URL
- https://github.com/open-webui/open-webui/commit/dc4924b66e655b315e3be4430a3e51b7... Patch
- https://github.com/open-webui/open-webui/pull/26046 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-59225 Vendor Advisory
- https://github.com/advisories/GHSA-m3qf-58wf-w979
- https://github.com/open-webui/open-webui/security/advisories/GHSA-m3qf-58wf-w979 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59225... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published9 Jul 2026
Updated4 Nov 2026
First seen9 Jul 2026
Track software like this
Free during beta