Summary
Open WebUI: Arena task endpoints can bypass underlying model access controls
An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions.
The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected submodel's access check.
Technical Details
Open WebUI's current model-access behavior already denies direct access to the restricted model. The normal chat path also denies the selected restricted model after arena preprocessing. The task endpoint path is inconsistent with that protected behavior because it reaches the same restricted model only through the direct arena fallback and recursive bypass_filter=True.
This report does not rely on malicious provider configuration, user-authored Tools/Functions, or direct code execution. The crossed boundary is model read authorization.
Although the arena wrapper must be readable by the user, this is not just an "admin exposed a restricted model" configuration claim. The same configured arena is denied by the normal chat post-preprocessor control once the selected restricted model is the dispatch target. The bypass is specific to task endpoints that skip that preprocessor and enter the fallback arena resolver.
Official documentation also points to this interpretation:
- Open WebUI documents model access control as restricting models to specific users or groups.
- The workspace-model documentation treats "wrapper checked, restricted underlying model reached" as broken access control and recommends independent entries for curated deployments.
- The evaluation documentation describes arena mode as an evaluation/comparison feature that randomly selects models to compare, not as a feature that grants access to otherwise restricted models.
- This is not an unsafe-admin-action report: the same intended model access restriction is enforced on the direct model path and on the normal-chat selected-model control, then bypassed only through the task endpoint call order.
PoV
The attached local PoV does not start a server and does not contact any model provider. It imports the current Open WebUI task endpoint and replaces provider dispatch plus model-access checks with local stubs so the call graph can be observed safely.
Observed result:
| Case | Expected | Actual |
|---|---|---|
Direct task request with model=restricted-model |
Denied before provider dispatch | Denied; no provider call recorded |
Normal-chat post-preprocessor control with model=restricted-model and metadata.selected_model_id=restricted-model |
Denied before provider dispatch | Denied; no provider call recorded |
Task request with model=public-arena that selects restricted-model |
Denied when selected model is restricted | Local provider stub reached with model=restricted-model and bypass_filter=true |
In the arena task case, the restricted model is absent from the access-check log.
Appendix: Affected Components
backend/open_webui/routers/tasks.py/api/v1/tasks/moa/completionsbuilds a payload from caller-controlledmodel,prompt, andresponses, then callsgenerate_chat_completion(request, form_data=payload, user=user).backend/open_webui/utils/chat.py- checks access for the user-supplied arena wrapper model.
- fallback arena resolution selects an underlying model when the caller did not pass through
process_chat_payload(). - recursive dispatch uses
bypass_filter=True. backend/open_webui/utils/models.py- arena wrapper access checks only wrapper
access_grants.
Current-head references:
backend/open_webui/routers/tasks.py:662-707backend/open_webui/utils/chat.py:190-204backend/open_webui/utils/chat.py:215-240backend/open_webui/utils/chat.py:248-269backend/open_webui/utils/middleware.py:2323-2347backend/open_webui/utils/models.py:378-407
Appendix: Duplicate Analysis
This is distinct from GHSA-9vvh-qmjx-p4q8 / CVE-2026-44555, which covers base_model_id chaining and user-created workspace models. Current head includes the base-model-chain access fix through has_base_model_access.
This report covers task endpoints that call generate_chat_completion() without the main chat preprocessor. The root cause is arena fallback plus recursive bypass_filter=True, not base_model_id.
Live duplicate sweep before submission also reviewed:
GHSA-v6qf-75pr-p96m: exposed HTTP query parameter?bypass_filter=true. This report does not rely on caller-controlled query parameters; the task endpoint reaches the server-side recursivebypass_filter=Truepath after arena fallback resolution.GHSA-hp5m-24vp-vq2q:/api/openai/responsespassthrough missing model authorization. This report targets/api/v1/tasks/moa/completionsand the arena resolver insideutils.chat.generate_chat_completion().GHSA-gfm2-xm6c-37qc: chat ownership authorization in completions. This report does not require another user's chat ID.
If maintainers prefer to treat this as the same broad "wrapper checked, underlying model not checked" class, it should still be a distinct exploitation vector and affected component: task endpoints, not model creation/import or base_model_id dispatch.
Appendix: Preconditions
- Authenticated non-admin user.
- The user can read an arena wrapper model, for example a custom arena with a public read grant.
- The arena model includes at least one restricted underlying model that the user cannot query directly.
Impact
A regular user can use a readable arena wrapper as an oracle for a restricted model via task-generation endpoints. For /api/v1/tasks/moa/completions, the caller controls the task prompt and receives the generated response.
The crossed security boundary is model read authorization: a non-admin user who is denied direct access to a model can still cause Open WebUI to dispatch a request to that model with the operator-configured backend credentials.
This can allow:
- use of paid or internal models with the admin-configured provider key;
- bypass of model access grants shown in the model selector;
- cost and usage impact on pay-per-token providers;
- exposure of model behavior or internal deployment capabilities that admins intended to restrict.
Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L = 7.6.
Primary CWE: CWE-862, Missing Authorization.
Authentication is required, so PR:L is used. User interaction is not required. The confidentiality impact is High because the attacker can query a model the administrator intended to restrict. Integrity and availability are Low because the request can consume provider quota and produce model output under an authorization decision the system would otherwise deny.
This should not be Critical: exploitation requires an authenticated user and a readable arena wrapper, does not cross into another security authority, and does not provide arbitrary code execution or full instance compromise.
The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.
CVE-2026-59225 has a CVSS score of 5.4 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.10.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Do not use bypass_filter=True for arena fallback dispatch unless the selected underlying model has already been authorized for the caller.
Recommended changes:
- after selecting
selected_model_id, load the selected model and callcheck_model_access(user, selected_model)before recursive dispatch; - for
filter_mode=excludeor emptymodel_ids, build the candidate pool from models the current user can read, not every non-arena model inrequest.app.state.MODELS; - add regression tests for
/api/v1/tasks/moa/completions,/api/v1/tasks/title/completions,/api/v1/tasks/tags/completions, and normal/api/chat/completionsarena behavior.
Frequently Asked Questions
- What is CVE-2026-59225? CVE-2026-59225 is a medium-severity missing authorization vulnerability in open-webui (pip), affecting versions >= 0.8.12, < 0.10.0. It is fixed in 0.10.0. The application does not perform an authorization check before performing a sensitive operation.
- How severe is CVE-2026-59225? CVE-2026-59225 has a CVSS score of 5.4 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of open-webui are affected by CVE-2026-59225? open-webui (pip) versions >= 0.8.12, < 0.10.0 is affected.
- Is there a fix for CVE-2026-59225? Yes. CVE-2026-59225 is fixed in 0.10.0. Upgrade to this version or later.
- Is CVE-2026-59225 exploitable, and should I be worried? Whether CVE-2026-59225 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-59225 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-59225? Upgrade
open-webuito 0.10.0 or later.