CVE-2026-59225: Open WebUI Arena Model Access Control Bypass (v0.8.12–0.9.x)

Technical summary

The vulnerability arises from inconsistent access control logic between two request paths in Open WebUI. The standard chat endpoint performs arena model resolution early and re-validates access to the selected underlying model before dispatch. The task endpoints (such as /api/v1/tasks/moa/completions) bypass this pattern by calling utils.chat.generate_chat_completion() directly. In this path, arena fallback resolution occurs after the initial wrapper access check, then recurses with bypass_filter=True, which suppresses the access validation for the underlying model. This allows an authenticated user to read-access models they lack explicit permission to use, violating the principle of least privilege.

Business impact

This vulnerability creates a data confidentiality risk in multi-tenant or role-segregated Open WebUI deployments. Authenticated users can access AI models or their outputs beyond their intended authorization scope, potentially exposing proprietary model outputs, sensitive training data, or unvetted AI responses. For organizations using Open WebUI to manage different AI models with varying access levels (such as production-grade models restricted to certain teams), this bypass undermines access control governance. The medium CVSS score reflects that exploitation requires authentication and network access, but no interactive user action.

Affected systems

Open WebUI versions 0.8.12 through 0.9.x are affected. Version 0.10.0 and later contain the fix. Organizations running self-hosted Open WebUI instances with multi-user or role-based access control should verify their deployment version immediately.

Exploitability

Exploitation is straightforward for any authenticated, non-admin user. No special privileges, physical access, or user interaction is required. The attacker simply needs valid credentials and the ability to send HTTP requests to task endpoints. Network access is assumed (CVSS AV:N). The bypass is deterministic—any authenticated user with read access to an arena wrapper will succeed in accessing underlying restricted models, making this a high-confidence attack vector in affected deployments.

Remediation

Upgrade Open WebUI to version 0.10.0 or later. This version restores consistent access control validation across all request paths, ensuring that arena fallback resolution respects the underlying model's access restrictions without the bypass_filter override. For organizations unable to upgrade immediately, restrict task endpoint access via network segmentation or reverse proxy rules until patches can be deployed.

Patch guidance

Apply the official Open WebUI update to version 0.10.0 or newer as soon as feasible. Verify the update in a staging environment before production deployment to ensure no integration disruptions. Check the official Open WebUI repository and release notes for any configuration changes or migration steps accompanying the patch.

Detection guidance

Monitor logs for repeated calls to /api/v1/tasks/moa/completions and similar task endpoints from non-admin authenticated users, especially if those calls reference models the user lacks explicit read permissions for. Log access patterns to arena wrapper models followed by direct task-endpoint calls to underlying models. Implement alerting for unauthorized model access attempts or unusual task endpoint activity from lower-privileged accounts. If available, enable debug logging in Open WebUI to trace the bypass_filter flag and arena resolution logic during task processing.

Why prioritize this

While the CVSS score of 5.4 (MEDIUM) reflects the authentication requirement, the vulnerability should be prioritized in environments with strict model access controls or multi-team deployments. The ease of exploitation, combined with the direct circumvention of intentional access restrictions, makes it a governance and data confidentiality concern even if not a critical system compromise vector. Organizations managing competitive or sensitive AI models should treat this as high priority within their patch schedule.

Risk score, explained

CVSS 3.1 score of 5.4 (MEDIUM) reflects: Attack Vector Network (AV:N—accessible remotely), Attack Complexity Low (AC:L—no special conditions), Privileges Required (PR:L—authentication mandatory), User Interaction None (UI:N—no user action needed), Scope Unchanged (S:U), Confidentiality Low (C:L—unauthorized model/data access), Integrity None (I:N), Availability Low (A:L—potential denial via resource exhaustion through repeated unauthorized calls). The score appropriately captures that this is an authenticated privilege escalation with confidentiality impact, not a critical remote code execution or complete system compromise.

Frequently asked questions