CVE-2026-59225: CVE-2026-59225: Access Control Bypass in Open WebUI Arena Task Endpoints

#security #cve #cybersecurity

CVE-2026-59225: Access Control Bypass in Open WebUI Arena Task Endpoints

Vulnerability ID: CVE-2026-59225
CVSS Score: 5.4
Published: 2026-07-24

A missing authorization vulnerability (CWE-862) exists in Open WebUI from version 0.8.12 before 0.10.0. This flaw allows authenticated non-administrative users to access restricted underlying backend models via specific task endpoints, bypassing configured model permissions.

TL;DR

Authenticated users can bypass model restrictions to query unauthorized backend models via task endpoints.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-862
Attack Vector: Network (AV:N)
CVSS Score: 5.4 (Medium)
EPSS Score: 0.00211
Impact: Confidentiality, Availability (Low)
Exploit Status: PoC
KEV Status: Not Listed

Affected Systems

Open WebUI self-hosted AI platform
Open WebUI: >= 0.8.12, < 0.10.0 (Fixed in: 0.10.0)

Code Analysis

Commit: dc4924b

Fix model access bypass for arena and task endpoints

Exploit Details

GitHub Security Advisories: No description

Mitigation Strategies

Upgrade Open WebUI to version 0.10.0 or later.
Disable Arena wrapper models in the administration panel.
Implement reverse proxy rules to block access to '/api/v1/tasks/*' for unauthorized users.

Remediation Steps:

Pull the updated Docker image: docker pull ghcr.io/open-webui/open-webui:v0.10.0
Restart the container to apply the changes.
Verify model permissions across active Arena configurations.

References

Read the full report for CVE-2026-59225 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community