CVE-2026-59225: 
Open WebUI vulnerability analysis and mitigation

CVE-2026-59225 is a missing authorization vulnerability in Open WebUI, a self-hosted AI platform, that allows authenticated non-admin users to bypass access controls and reach restricted underlying AI models through task endpoints. It affects Open WebUI versions from 0.8.12 up to (but not including) 0.10.0. The vulnerability was published on July 9, 2026, with the fix merged on June 16, 2026, and released in version 0.10.0 on June 29, 2026. It carries a CVSS v3.1 base score of 6.3 (Medium) per NVD, or 5.4 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): task endpoints such as /api/v1/tasks/moa/completions call utils.chat.generate_chat_completion() directly, bypassing the process_chat_payload() preprocessor that the normal chat route uses to re-check model access after arena resolution. In the task path, arena fallback resolution selects an underlying model after the wrapper access check has already passed, then recurses with bypass_filter=True, which skips check_model_access() for the resolved submodel. The fix (commit dc4924b) adds an explicit check_model_access(user, selected_model) call on the resolved arena submodel before the bypass_filter=True recursion, mirroring the protection already present in the normal chat path. Exploitation requires only that the attacker is an authenticated non-admin user with read access to an arena wrapper model that includes at least one restricted underlying model (GitHub Advisory, Fix Commit).

A successful exploit allows a non-admin user to generate completions through AI models they are explicitly denied direct access to, using the administrator's configured backend credentials (e.g., API keys for paid or internal model providers). This results in unauthorized use of pay-per-token models (cost and quota impact), exposure of model behavior or capabilities the admin intended to restrict, and bypass of the model access grants visible in the model selector. Confidentiality and integrity are partially impacted — the attacker can query restricted models and receive their outputs — but there is no path to arbitrary code execution or full instance compromise (GitHub Advisory).

1. Reconnaissance: As an authenticated non-admin user, enumerate available arena wrapper models in the Open WebUI instance (e.g., via the model selector UI or the /api/v1/models endpoint) to identify a publicly readable arena model.
2. Identify restricted underlying models: Determine which underlying models are included in the arena wrapper but are not directly accessible to your account (e.g., by attempting direct access and receiving a denial).
3. Craft task endpoint request: Send an authenticated HTTP POST request to a task endpoint such as /api/v1/tasks/moa/completions, specifying the readable arena wrapper model as the model parameter and including a controlled prompt in the request body.
4. Trigger arena fallback: Because the task endpoint calls generate_chat_completion() directly without process_chat_payload(), the arena fallback resolver selects a restricted underlying model and recurses with bypass_filter=True, skipping the submodel's access check.
5. Receive restricted model output: The response contains completions generated by the restricted underlying model, dispatched using the administrator's configured provider credentials, effectively bypassing the intended access control (GitHub Advisory, Fix PR).

• Network/API Logs: Repeated authenticated POST requests to /api/v1/tasks/moa/completions, /api/v1/tasks/title/completions, or /api/v1/tasks/tags/completions from non-admin user accounts, especially where the specified model is an arena wrapper.
• Access Logs: Log entries showing a non-admin user successfully receiving completions from a model they are denied access to on the direct /api/chat/completions route.
• Usage Anomalies: Unexpected spikes in token consumption or API costs on restricted model provider accounts (e.g., OpenAI, Anthropic) not attributable to admin or authorized users.
• Application Logs: Absence of check_model_access denial log entries for restricted models in sessions where arena task endpoints were used, indicating the access check was bypassed (GitHub Advisory).

Upgrade Open WebUI to version 0.10.0 or later, which enforces check_model_access() on the resolved arena submodel before bypass_filter=True recursion in all task endpoint paths (v0.10.0 Release, Fix Commit). As a temporary workaround for deployments that cannot immediately upgrade, restrict access to task endpoints (/api/v1/tasks/*) to trusted or admin users only via network-level controls or a reverse proxy, or disable task-based features if not required. Administrators should also audit arena wrapper model configurations to ensure restricted models are not inadvertently included in publicly readable arenas (GitHub Advisory).

The vulnerability was reported by security researcher rexpository and remediated by contributor Classic298 via pull request #26046, merged on June 16, 2026. The Open WebUI maintainers included it in the v0.10.0 security advisory section with the note: "Model access enforced on arena fallback. Reaching a model indirectly through an arena model on background and task requests now enforces that model's access rules, closing a path that could otherwise bypass them." The NixOS security tracker also flagged the issue for the nixpkgs open-webui package (v0.10.0 Release, Fix PR).