CVE-2026-59225: Access Control Bypass in Open WebUI Arena Task Endpoints

Open WebUI is an extensible, user-friendly, self-hosted interface designed for interacting with large language models. To manage access to varied models, the system incorporates detailed access control policies. These policies govern which users or groups can interact with specific upstream LLMs, local models, or virtual models. The application supports virtual model definitions, such as Arena wrapper models, which represent multi-model evaluation systems or routers that balance or arbitrate requests across backend targets.

The vulnerability, identified as CVE-2026-59225, resides in the task-execution endpoints of the platform, such as the mixture-of-agents completions endpoint. These specific endpoints execute secondary backend tasks including tagging, auto-titling, or compound model completions. Due to an architectural difference in how request payloads are preprocessed, these endpoints do not follow the standard chat resolution pipeline. This deviation permits low-privileged users with access to an Arena wrapper model to query restricted underlying submodels.

This flaw represents a breakdown in logical access controls, categorized under CWE-862 (Missing Authorization). It exposes restricted underlying assets, potentially incurring significant API usage fees or exposing proprietary models to unauthorized internal users. The flaw has been successfully patched in Open WebUI version 0.10.0 by introducing active authorization checks within the direct dispatch execution path.

To understand the root cause of CVE-2026-59225, one must analyze the distinction between the standard chat routing pipeline and the task execution pipeline. In standard operations, when a user queries a model, the request is processed by the process_chat_payload preprocessor. This middleware intercepts the selected model configuration, resolves virtual wrapper models to concrete submodels, and systematically invokes check_model_access on both the wrapper and the target models. If either authorization check fails, the transaction is immediately terminated before reaching the model dispatch routine.

Conversely, task-generation endpoints, such as /api/v1/tasks/moa/completions, bypass the standard middleware stack. These endpoints call the internal model dispatch utility, specifically utils.chat.generate_chat_completion(), directly. Because this utility receives raw payloads, it performs its own localized access check. While it successfully validates whether the user is authorized to call the initial model (the Arena wrapper), it must subsequently resolve the wrapper to its designated concrete submodel.

Upon identifying the concrete submodel, generate_chat_completion() triggers a recursive self-call to generate the actual completion. To prevent infinite loops and avoid re-running processing filters on the internal call, the developers configured this recursive dispatch with the parameter bypass_filter=True. Crucially, the internal model access check inside generate_chat_completion() is conditioned on the state of bypass_filter. Because the recursive call sets this parameter to true, the second-pass authorization check for the resolved restricted submodel is skipped entirely.

The vulnerability is localized to backend/open_webui/utils/chat.py within the generate_chat_completion routine. In vulnerable versions, when the router parses an Arena or mixture-of-agents model, the target submodel is resolved dynamically and the routing proceeds recursively.

# Vulnerable code structure in generate_chat_completion
async def generate_chat_completion(
    request: Request,
    form_data: dict,
    user: User,
    bypass_filter: bool = False,
):
    # Initial check only occurs if bypass_filter is False
    if not bypass_filter:
        # Checks access for the user-supplied model identifier (the wrapper)
        await check_model_access(user, model)
 
    # ... resolution logic for Arena wrapper models ...
    if is_arena_model:
        selected_model_id = resolve_arena_model(model)
        form_data['model'] = selected_model_id
        # Recursion bypasses the filter, meaning subsequent check_model_access is skipped
        return await generate_chat_completion(
            request, form_data, user, bypass_filter=True
        )

The patch introduced in commit dc4924b66e655b315e3be4430a3e51b7d5c20acc inserts an explicit check directly into the resolution block, ensuring that the resolved submodel is audited before the recursive call occurs.

# Patched logic in backend/open_webui/utils/chat.py
            form_data['model'] = selected_model_id
 
            # bypass_filter recursion below skips the line-200 check; gate the resolved model here.
            if not bypass_filter and user.role == 'user':
                selected_model = request.app.state.MODELS.get(selected_model_id)
                if selected_model:
                    await check_model_access(user, selected_model)

This correction ensures that if the caller is a standard user, the newly selected model undergoes verification against the user's explicit model access control list. Since this validation occurs while bypass_filter is still evaluated as false in the outer scope, unauthorized requests are blocked and the function raises an HTTP 403 exception prior to entering the recursive call.

Exploitation of CVE-2026-59225 requires the attacker to possess a valid low-privileged account on the target Open WebUI instance. The attacker must also identify an active Arena wrapper model that standard users are authorized to query. If this Arena model contains restricted, premium, or private submodels in its selection pool, the exploit vector is viable.

An attacker interacts directly with the task completions endpoint instead of utilizing the frontend chat interface. The target endpoint, /api/v1/tasks/moa/completions, expects a structured JSON payload defining the target model and prompt structure. By specifying the accessible Arena model in the request payload, the attacker forces the system to trigger the vulnerable dispatch logic.

The internal routing mechanism resolves the Arena wrapper to a restricted model. Because the subsequent dispatch is called with bypass_filter=True, no permissions are validated on the final model destination. The application acts as a proxy, querying the unauthorized model via its configured administrative API key and delivering the result to the attacker.

The primary impact of this vulnerability is unauthorized access to models that administrators have explicitly restricted. This bypass allows low-privileged users to query arbitrary high-cost or proprietary upstream LLMs. In enterprise settings, this can lead to unexpected financial liabilities due to unauthorized token consumption on commercial APIs.

Additionally, the vulnerability carries confidentiality risks. Administrators often restrict specific models because they process sensitive, internal, or regulated training datasets. By bypassing access controls, standard users can exfiltrate or query data managed exclusively by those secure model endpoints.

From a CVSS v3.1 perspective, the severity is evaluated as Medium (5.4). The attack vector is Network, and the complexity is Low since the exploitation relies on standard API behavior without timing constraints or complex race conditions. While integrity is unaffected, confidentiality and availability (through resource exhaustion) receive a low impact rating.

The definitive solution for CVE-2026-59225 is upgrading the Open WebUI instance to version 0.10.0 or later. This version incorporates the patch that explicitly validates submodel access before the recursive generation phase is initiated. Deployments using Docker can be updated by pulling the latest tag from the GitHub Container Registry.

If immediate upgrading is not feasible, administrators can apply tactical workarounds to reduce exposure. One approach is to disable or delete all Arena wrapper models and Mixture of Agents (MOA) structures within the admin console. Alternatively, administrators can modify the candidate pools of existing Arena wrapper models to ensure they contain only standard, unrestricted submodels.

For network-level defense, administrators can configure reverse proxies or Web Application Firewalls (WAF) to intercept and block incoming traffic to task endpoints. Filtering access to routes matching /api/v1/tasks/* for non-administrative API keys will block the exploit vector while preserving normal chat functionality.