Missing Authorization in Open WebUI - #VU136851

Detailed vulnerability description

The vulnerability allows a remote user to bypass model access controls and disclose restricted model output.

The vulnerability exists due to missing authorization in task endpoints and the arena fallback resolver in generate_chat_completion() when handling task completion requests through a readable arena wrapper model that resolves to a restricted underlying model. A remote user can send a crafted task completion request to bypass model access controls and disclose restricted model output.

The issue affects task routes that call generate_chat_completion() directly, where arena fallback recursion uses bypass_filter=true after wrapper access is checked. The caller must be able to read the arena wrapper model.

Remediation

Sources

• https://github.com/open-webui/open-webui/security/advisories/GHSA-m3qf-58wf-w979