Vulnerability · Published May 15, 2026 · Assigned by GitHub_M
CVE-2026-44555Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining
High 7.6
In plain English
A high-severity missing authorization in open-webui from open-webui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via base_model_id: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model. Additionally, the model creation and import endpoints accept arbitrary base_model_id values without checking that the caller has access to that base model. Combined, this allows any user with the default model creation permission to create a model that chains to a restricted base model — and then invoke it, causing the server to dispatch the request to the restricted base model using the admin-configured API key. This vulnerability is fixed in 0.9.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | open-webui | 0.9.0 | GHSA-9vvh-qmjx-p4q8 |
| PyPI | open-webui | 0.9.0 | PYSEC-2026-2719 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-webui | open-webui | < 0.9.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
References
- https://github.com/open-webui/open-webui/security/advisories/GHSA-9vvh-qmjx-p4q8 x_refsource_CONFIRM