Executive brief
Open WebUI, a popular interface for interacting with AI models, contains a vulnerability that allows users to bypass access controls on restricted AI models. By creating a custom model that 'chains' to a restricted base model, a regular user can gain unauthorized access to premium or private AI services. This can lead to unauthorized data processing and unexpected costs for the organization, as the system uses the administrator's API keys to fulfill these requests.
Technical details
A missing authorization check (CWE-862) exists in Open WebUI's model creation and chat completion pipelines. When a user creates a model via the `/api/v1/models/create` or import endpoints, the system fails to verify if the user has permission to use the specified `base_model_id`. During chat completion, the backend resolves the user-facing model to its base model and rewrites the request payload without re-verifying access to the underlying base model. This allows an authenticated attacker with default model creation permissions to proxy requests to restricted models (e.g., GPT-4) using the server's configured credentials. The vulnerability is addressed in version 0.9.0.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-05-05: disclosed: Vulnerability reported to vendor
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-08: patched: Version 0.9.0 released
- 2026-05-15: other: NVD publication date