CVE-2026-59227: 
Open WebUI vulnerability analysis and mitigation

CVE-2026-59227 is an authorization bypass vulnerability in Open WebUI, a self-hosted AI platform, affecting the POST /api/v1/images/edit endpoint. Versions from 0.8.11 through before 0.10.0 are affected; the route was introduced in 0.8.11 and was ungated from the outset. The vulnerability was disclosed via a GitHub Security Advisory on June 29, 2026, and patched in version 0.10.0 released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, or 4.3 (Medium) per the GitHub advisory (GitHub Advisory).

The root cause is a missing and incorrect authorization check (CWE-862, CWE-863) on the POST /api/v1/images/edit route in backend/open_webui/routers/images.py. While every other image-editing surface in Open WebUI — including POST /api/v1/images/generations, the built-in edit_image tool, and the chat image-edit middleware — enforces both the global ENABLE_IMAGE_EDIT switch and the per-user features.image_generation permission, the direct /edit route relied solely on Depends(get_verified_user) and proceeded directly to provider dispatch with no further checks (GitHub Advisory, Patch Commit). The fix adds a thin wrapper that checks ENABLE_IMAGE_EDIT and the per-user permission before delegating to the shared image_edits() implementation, mirroring the pattern used by the image generation route (PR #26009).

Any authenticated, non-admin user can invoke server-side image editing operations using administrator-configured provider credentials (e.g., IMAGES_EDIT_OPENAI_API_KEY for OpenAI-compatible engines, or credentials for Gemini and ComfyUI), even when the administrator has globally disabled image editing (ENABLE_IMAGE_EDIT=False) or explicitly denied the user image-generation permission. The primary impacts are integrity and availability: unauthorized consumption of billable API resources and bypass of administrator access controls. No cross-user data is exposed and provider credentials are never returned to the caller, so confidentiality impact is none (GitHub Advisory).

1. Obtain a verified account: Register or obtain credentials for any non-admin verified account on the target Open WebUI instance running versions 0.8.11 through 0.9.x.
2. Authenticate and retrieve a bearer token: Log in via the Open WebUI interface or API to obtain a valid JWT bearer token for the non-admin account.
3. Craft the malicious request: Prepare a POST /api/v1/images/edit request with the bearer token in the Authorization header, Content-Type: application/json, and a JSON body containing a base64-encoded image, a prompt, and a target model (e.g., gpt-image-1):

   POST /api/v1/images/edit
   Authorization: Bearer <non-admin-token>
   Content-Type: application/json
   
   {"image":"data:image/png;base64,<base64-encoded-image>","prompt":"edit","model":"gpt-image-1"}

4. Submit the request: Send the request to the Open WebUI server. The endpoint bypasses the ENABLE_IMAGE_EDIT global switch and per-user permission checks, forwarding the request directly to the configured image-edit provider using administrator credentials.
5. Receive the result: The server returns an edited image from the provider, confirming the bypass and consuming billable API resources under the administrator's credentials (GitHub Advisory).

• Network: Unexpected POST /api/v1/images/edit requests originating from non-admin user accounts, particularly when ENABLE_IMAGE_EDIT=False is configured; outbound API calls to OpenAI, Gemini, or ComfyUI image-edit endpoints initiated by the Open WebUI server.
• Logs: Open WebUI access logs showing POST /api/v1/images/edit requests authenticated with non-admin bearer tokens returning HTTP 200 responses; unexpected spikes in image-edit API usage in provider billing dashboards (e.g., OpenAI usage logs for IMAGES_EDIT_OPENAI_API_KEY).
• Application Behavior: Image-edit operations succeeding for users who have been explicitly denied features.image_generation permission, or when the global image-edit feature is disabled in the admin panel.

Upgrade Open WebUI to version 0.10.0 or later, which enforces ENABLE_IMAGE_EDIT and the per-user features.image_generation permission on the POST /api/v1/images/edit endpoint (GitHub Release v0.10.0, Patch Commit). For instances unable to upgrade immediately, restrict network-level access to the POST /api/v1/images/edit endpoint (e.g., via a reverse proxy or WAF rule) and audit recent image-editing activity for unauthorized usage with administrator credentials. Rotating the IMAGES_EDIT_OPENAI_API_KEY and equivalent provider credentials is also advisable if unauthorized usage is suspected (GitHub Advisory).