Executive brief
Open WebUI is an interface for interacting with large language models. A vulnerability in the model import feature allows users with basic import permissions to overwrite any existing AI model on the system, regardless of who owns it. An attacker could use this to modify a model's behavior, change its instructions to exfiltrate data, or grant themselves unauthorized access to private models, potentially compromising the integrity of AI-driven business processes.
Technical details
The vulnerability exists in the `import_models` function within `backend/open_webui/routers/models.py`. The `POST /api/v1/models/import` endpoint fails to verify model ownership or perform authorization checks when an imported model ID matches an existing one. It merges the attacker-supplied payload directly into the existing model data and updates the database without calling `filter_allowed_access_grants`. An attacker with `workspace.models_import` permissions can remotely overwrite any model's system prompt, base model routing, or access grants (e.g., making a private model public). This bypasses the security controls enforced on standard model mutation endpoints.
Affected products
- Open WebUI Open WebUI <= 0.8.12
Timeline
- 2026-05-05: disclosed: Initial report to vendor
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-15: patched: Fix released in version 0.9.0