| Package | Affected versions | Patched versions |
|---|---|---|
| open-webui | ≥ 0.8.12, < 0.10.0 | 0.10.0 |
| open webui | ≥ 0.8.12, < 0.10.0 | 0.10.0 |
An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions.
The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected submodel's access check.
Open WebUI's current model-access behavior already denies direct access to the restricted model. The normal chat path also denies the selected restricted model after arena preprocessing. The task endpoint path is inconsistent with that protected behavior because it reaches the same restricted model only through the direct arena fallback and recursive bypass_filter=True.
This report does not rely on malicious provider configuration, user-authored Tools/Functions, or direct code execution. The crossed boundary is model read authorization.
Although the arena wrapper must be readable by the user, this is not just an "admin exposed a restricted model" configuration claim. The same configured arena is denied by the normal chat post-preprocessor control once the selected restricted model is the dispatch target. The bypass is specific to task endpoints that skip that preprocessor and enter the fallback arena resolver.
Official documentation also points to this interpretation:
The attached local PoV does not start a server and does not contact any model provider. It imports the current Open WebUI task endpoint and replaces provider dispatch plus model-access checks with local stubs so the call graph can be observed safely.
Observed result:
| Case | Expected | Actual |
|---|
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeDirect task request with model=restricted-model | Denied before provider dispatch | Denied; no provider call recorded |
Normal-chat post-preprocessor control with model=restricted-model and metadata.selected_model_id=restricted-model | Denied before provider dispatch | Denied; no provider call recorded |
Task request with model=public-arena that selects restricted-model | Denied when selected model is restricted | Local provider stub reached with model=restricted-model and bypass_filter=true |
In the arena task case, the restricted model is absent from the access-check log.
A regular user can use a readable arena wrapper as an oracle for a restricted model via task-generation endpoints. For /api/v1/tasks/moa/completions, the caller controls the task prompt and receives the generated response.
The crossed security boundary is model read authorization: a non-admin user who is denied direct access to a model can still cause Open WebUI to dispatch a request to that model with the operator-configured backend credentials.
This can allow:
Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L = 7.6.
Primary CWE: CWE-862, Missing Authorization.
Authentication is required, so PR:L is used. User interaction is not required. The confidentiality impact is High because the attacker can query a model the administrator intended to restrict. Integrity and availability are Low because the request can consume provider quota and produce model output under an authorization decision the system would otherwise deny.
This should not be Critical: exploitation requires an authenticated user and a readable arena wrapper, does not cross into another security authority, and does not provide arbitrary code execution or full instance compromise.
Do not use bypass_filter=True for arena fallback dispatch unless the selected underlying model has already been authorized for the caller.
Recommended changes:
selected_model_id, load the selected model and call check_model_access(user, selected_model) before recursive dispatch;filter_mode=exclude or empty model_ids, build the candidate pool from models the current user can read, not every non-arena model in request.app.state.MODELS;/api/v1/tasks/moa/completions, /api/v1/tasks/title/completions, /api/v1/tasks/tags/completions, and normal /api/chat/completions arena behavior.backend/open_webui/routers/tasks.py/api/v1/tasks/moa/completions builds a payload from caller-controlled model, prompt, and responses, then calls generate_chat_completion(request, form_data=payload, user=user).backend/open_webui/utils/chat.pyprocess_chat_payload().bypass_filter=True.backend/open_webui/utils/models.pyaccess_grants.Current-head references:
backend/open_webui/routers/tasks.py:662-707backend/open_webui/utils/chat.py:190-204backend/open_webui/utils/chat.py:215-240backend/open_webui/utils/chat.py:248-269backend/open_webui/utils/middleware.py:2323-2347backend/open_webui/utils/models.py:378-407This is distinct from GHSA-9vvh-qmjx-p4q8 / CVE-2026-44555, which covers base_model_id chaining and user-created workspace models. Current head includes the base-model-chain access fix through has_base_model_access.
This report covers task endpoints that call generate_chat_completion() without the main chat preprocessor. The root cause is arena fallback plus recursive bypass_filter=True, not base_model_id.
Live duplicate sweep before submission also reviewed:
GHSA-v6qf-75pr-p96m: exposed HTTP query parameter ?bypass_filter=true. This report does not rely on caller-controlled query parameters; the task endpoint reaches the server-side recursive bypass_filter=True path after arena fallback resolution.GHSA-hp5m-24vp-vq2q: /api/openai/responses passthrough missing model authorization. This report targets /api/v1/tasks/moa/completions and the arena resolver inside utils.chat.generate_chat_completion().GHSA-gfm2-xm6c-37qc: chat ownership authorization in completions. This report does not require another user's chat ID.If maintainers prefer to treat this as the same broad "wrapper checked, underlying model not checked" class, it should still be a distinct exploitation vector and affected component: task endpoints, not model creation/import or base_model_id dispatch.