PT-2026-56888 · Openwebui · Open-Webui

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-59225

Mitre

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate chat completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass filter=True, skipping the selected submodel's access check. This issue is fixed in version 0.10.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-59225

Affected Products

Open-Webui

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-59225 · Security Note
• https://github.com/open-webui/open-webui/security/advisories/GHSA-m3qf-58wf-w979 · Note
• https://github.com/open-webui/open-webui/pull/26046 · Note
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 · Note
• https://github.com/open-webui/open-webui/commit/dc4924b66e655b315e3be4430a3e51b7d5c20acc · Note