Open WebUI: Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
- Record
- CVE-2026-44555
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via base_model_id: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model. Additionally, the model creation and import endpoints accept arbitrary base_model_id values without checking that the caller has access to that base model. Combined, this allows any user with the default model creation permission to create a model that chains to a restricted base model — and then invoke it, causing the server to dispatch the request to the restricted base model using the admin-configured API key. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a self-hosted chat program that lets people in your organization talk to AI models. This flaw affects all versions before 0.9.0. Open WebUI lets users build their own custom model on top of an existing AI model, but it does not check whether the user is allowed to use that underlying model. Any signed-in user who has the default permission to create models could build a model on top of an AI model an administrator restricted, then use it, and your server would send the request with the access key your administrator set up. This flaw is rated High.
What to do
- If someone on your staff or a volunteer installed and runs Open WebUI, that person should act on this flaw.
- That person should update Open WebUI to version
0.9.0or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to
0.9.0will be done. - No workaround or setting change is named for this flaw, so updating is the way to fix it. Check the vendor advisory linked on this page for the update details.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.