CVE-2026-45396: Open WebUI mass assignment in feedback endpoint

Executive brief

Open WebUI, a popular interface for interacting with large language models, contains a vulnerability in its feedback system. An authenticated user can submit feedback that appears to come from a different user, allowing them to impersonate others or manipulate model evaluation leaderboards. This could lead to unreliable performance metrics and damage the integrity of organizational model assessments.

Technical details

The POST /api/v1/evaluations/feedback endpoint in Open WebUI is vulnerable to mass assignment. The FeedbackForm Pydantic model uses ConfigDict(extra='allow'), which permits arbitrary fields in the request body. Furthermore, the insert_new_feedback function uses an insecure dictionary merge order where user-provided data is spread after server-set values (like user_id), allowing the user-provided values to overwrite the authenticated user's identity. An attacker can use this to attribute feedback to any user ID, corrupting Elo ratings and model leaderboards. The issue is fixed in version 0.9.5.

Affected products

• Open WebUI Open WebUI < 0.9.5

Timeline

• 2026-05-10: disclosed
• 2026-05-14: advisory: GitHub Advisory GHSA-rjmp-vjf2-qf4g published
• 2026-05-14: patched: Version 0.9.5 released

References

• https://api.github.com/users/yantongggg
• https://github.com/yantongggg
• https://api.github.com/users/yantongggg/gists%7B/gist_id%7D
• https://api.github.com/users/yantongggg/repos
• https://avatars.githubusercontent.com/u/135870728?v=4
• https://api.github.com/users/yantongggg/events%7B/privacy%7D