Executive brief
freegpt-webui is a web interface that provides access to AI language models through a backend API service. The backend conversation endpoint does not perform authentication checks, allowing unauthenticated users to call the API, consume expensive upstream AI resources (like GPT-4), and bypass content safety filters. This degrades service for legitimate users and exposes the upstream AI providers to resource exhaustion attacks.
Technical details
The vulnerability is a missing authentication (CWE-306) in the /backend-api/v2/conversation endpoint of the Backend Conversation API component in server/backend.py. The vulnerable _conversation function accepts a 'model' parameter without validating it against the server's configured whitelist in server/config.py, and performs no login, API key, session, or rate-limiting checks. An unauthenticated attacker can remotely send POST requests with arbitrary model names and jailbreak parameters to exhaust rate limits on upstream free AI providers and trigger content safety bypass. The product operates on a rolling release basis with no versioning, affects only unsupported instances, and is now archived.
Affected products
- ramon-victor freegpt-webui up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc
Timeline
- 2026-07-18: disclosed: Advisory published on GitHub Gist
- 2026-09-04: advisory: CVE-2026-85702 published on NVD