What is the CVSS score of CVE-2026-59225?

CVE-2026-59225 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-59225?

Yes, a public proof-of-concept exploit is available for CVE-2026-59225. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-59225?

Yes, a patch is available for CVE-2026-59225. Update the affected software to the latest version immediately.

Open WebUI CVE-2026-59225

EUVD-2026-42639 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 security-advisories@github.com

GHSA-m3qf-58wf-w979

Authentication Bypass Open Webui Openwebui

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

4.3 MEDIUM

Network-accessible task endpoint requires only low-privilege auth; impact is limited to unauthorized read access to restricted model outputs with no integrity or confirmed availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Jul 10, 2026 - 02:52 NVD

5.4 (MEDIUM) 6.3 (MEDIUM)

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:47 vuln.today

DescriptionNVD

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected submodel's access check. This issue is fixed in version 0.10.0.

AnalysisAI

Open WebUI versions 0.8.12 through 0.9.x expose a missing authorization flaw that permits authenticated non-admin users to reach restricted underlying AI models by exploiting a code-path divergence in task endpoints. The standard chat route (/api/v1/chat/completions) correctly re-validates submodel access after arena wrapper resolution, but task endpoints such as /api/v1/tasks/moa/completions call utils.chat.generate_chat_completion() directly, triggering arena fallback resolution after the wrapper check passes and recursing with bypass_filter=True - effectively nullifying the submodel access control. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only low-privilege authentication (PR:L), making it directly relevant to any multi-tenant or enterprise Open WebUI deployment with model access tiering.

Technical ContextAI

Open WebUI is a self-hosted AI platform built around a pluggable model abstraction that includes arena wrapper models - logical constructs that reference one or more underlying LLM backends (submodels). The authorization architecture assumes that access to a wrapper model does not implicitly confer access to its referenced submodels, and the standard chat dispatch enforces this by re-resolving and re-validating submodel access before final dispatch. The task endpoints bypass this guard by invoking utils.chat.generate_chat_completion() directly; within that code path, arena fallback resolution fires after the initial wrapper permission check succeeds and then triggers a recursive call carrying bypass_filter=True, an internal flag intended for trusted-system use that skips the submodel authorization gate entirely. The root cause is CWE-862 (Missing Authorization) - the authorization check is present in one execution path but absent in another that reaches the same privileged resource. The affected release range is confirmed by the GitHub advisory GHSA-m3qf-58wf-w979 as 0.8.12 to before 0.10.0.

RemediationAI

Vendor-released patch: Open WebUI 0.10.0. Upgrade to v0.10.0 or later immediately; the fix is confirmed via commit dc4924b66e655b315e3be4430a3e51b7d5c20acc (PR #26046, https://github.com/open-webui/open-webui/pull/26046) and the tagged release at https://github.com/open-webui/open-webui/releases/tag/v0.10.0. If upgrade is not immediately feasible, restrict all non-admin user access to arena wrapper models at the Open WebUI permission layer, which removes the prerequisite for exploitation - note this disables legitimate use of arena/MoA features for those users. Alternatively, block external access to the /api/v1/tasks/ endpoint family at the reverse proxy or network perimeter; this prevents exploitation but disables Mixture-of-Agents completion functionality. As an audit step, review which arena wrapper models are accessible to non-admin accounts and cross-reference the submodels they reference against access control policies to identify any historical unauthorized access.