CVE-2026-59225: 
Python vulnerability analysis and mitigation

CVE-2026-59225 is a Missing Authorization vulnerability in Open WebUI, a self-hosted AI platform, that allows authenticated non-admin users to bypass access controls and reach restricted underlying AI models through task endpoints. Affected versions span from 0.8.12 up to (but not including) 0.10.0. The vulnerability was published on July 9, 2026, with the fix merged on June 16, 2026, and released in version 0.10.0 on June 29, 2026. It carries a CVSS v3.1 base score of 6.3 (Medium) per NVD, and 5.4 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): task routes such as /api/v1/tasks/moa/completions call utils.chat.generate_chat_completion() directly, bypassing the process_chat_payload() preprocessor that the normal chat route uses to re-check model access after arena resolution. In the task path, arena fallback resolution selects an underlying model after the wrapper access check has already passed, then recurses with bypass_filter=True, which skips check_model_access() for the resolved submodel. The fix (commit dc4924b) inserts an explicit check_model_access(user, selected_model) call on the resolved model before the bypass_filter=True recursion, mirroring the protection already present in the normal chat path. Exploitation requires only that the attacker is an authenticated non-admin user with read access to an arena wrapper model that includes at least one restricted underlying model (GitHub Advisory, Fix Commit).

A successful exploit allows a non-admin user to generate completions through AI models they are explicitly denied direct access to, using the administrator's configured backend credentials (e.g., API keys for paid or internal model providers). This results in unauthorized use of pay-per-token models (cost and quota impact), exposure of model behavior or capabilities the admin intended to restrict, and a bypass of the model access grants visible in the model selector. Confidentiality, integrity, and availability are all partially impacted: the attacker can read restricted model outputs, influence model usage records, and consume provider quota (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.0021 (0.21%), indicating low near-term exploitation probability. Exploitation is not automatable per NVD SSVC assessment, as it requires an authenticated session and a specific arena wrapper configuration (Feedly).

1. Reconnaissance: Log in to the Open WebUI instance as a non-admin user. Enumerate available models in the model selector to identify any arena wrapper models the account has read access to.
2. Identify target: Confirm that the arena wrapper model includes at least one restricted underlying model (i.e., a model the user cannot query directly via the normal chat interface).
3. Craft task endpoint request: Send an authenticated HTTP POST request directly to a task endpoint such as /api/v1/tasks/moa/completions, specifying the arena wrapper model as the model parameter and including a crafted prompt in the request body.
4. Trigger arena fallback: Because the task endpoint calls generate_chat_completion() directly without process_chat_payload(), the arena fallback resolver selects the restricted underlying model and recurses with bypass_filter=True, skipping the submodel's access check.
5. Receive restricted model output: The restricted model processes the attacker-controlled prompt using the admin's backend credentials, and the response is returned to the attacker, exposing model capabilities and consuming provider quota (GitHub Advisory, Fix PR).

• Network/API Logs: Authenticated POST requests to /api/v1/tasks/moa/completions (or other /api/v1/tasks/*/completions endpoints) from non-admin user accounts, especially where the specified model is an arena wrapper.
• Application Logs: Log entries showing generate_chat_completion() invoked with bypass_filter=True for a model that the requesting user does not have direct access to; absence of check_model_access log entries for the resolved underlying model in task-path requests.
• Usage/Billing Anomalies: Unexpected spikes in API token consumption on restricted or paid model backends, particularly correlated with task endpoint activity from non-admin users.
• Access Pattern: A non-admin user repeatedly querying task endpoints with arena wrapper model IDs while having no direct access to the underlying models in the model selector (GitHub Advisory).

Upgrade Open WebUI to version 0.10.0 or later, which enforces check_model_access() on the resolved arena submodel before the bypass_filter=True recursion (v0.10.0 Release, Fix Commit). If immediate patching is not possible, restrict access to task endpoints (/api/v1/tasks/moa/completions and similar) to trusted or admin users only via network-level controls or reverse proxy ACLs, or disable task-based features if not required. Additionally, audit arena wrapper model configurations to ensure restricted underlying models are not included in arenas accessible to untrusted users (GitHub Advisory).

The vulnerability was reported by security researchers rexpository and Classic298, who also authored the fix pull request. The GitHub Security Advisory was published at a Moderate severity level, and the fix was merged promptly (June 16, 2026) and included in the v0.10.0 release (June 29, 2026) alongside a broad set of other security fixes. The NixOS security tracker also flagged the issue for the nixpkgs open-webui package (GitHub Advisory, Fix PR).