Open WebUI CVE-2026-59225

Exploitation requires an authenticated Open WebUI account with non-admin privileges (PR:L) and read access to at least one configured arena wrapper model. The referenced underlying submodel must be a restricted model that the non-admin user would otherwise be denied access to. Exploitation is limited to task endpoints (e.g., /api/v1/tasks/moa/completions) - the standard /api/v1/chat/completions route correctly re-validates submodel access and is not vulnerable. Deployments where no non-admin users have been granted access to any arena wrapper models are not exploitable via this path. Affected versions are strictly 0.8.12 through 0.9.x; Open WebUI 0.10.0 and later are not affected.

The NVD CVSS 3.1 score of 5.4 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) accurately captures the network-accessible, low-complexity nature of the flaw. EPSS data is absent from the provided intelligence, and the vulnerability is neither listed in CISA KEV nor associated with a public proof-of-concept at time of analysis. Real-world risk is contextually elevated above the raw score suggests: in environments deploying Open WebUI with premium, proprietary, compliance-restricted, or cost-metered backend models behind access tiers, unauthorized bypass could yield unauthorized consumption of expensive API quotas, circumvention of data governance controls, or access to outputs from models restricted for regulatory reasons. The A:L impact in the NVD vector is not clearly supported by the description - no availability impact is explicitly described - and may reflect anticipated resource exhaustion from unauthorized model consumption; this analysis treats that signal as uncertain. Exploitation is bounded by the requirement for a valid low-privilege account and access to at least one arena wrapper model, which limits the threat actor to insiders or compromised accounts rather than fully external unauthenticated attackers. This is a real remediation priority for shared-access deployments; single-user or fully-private instances face negligible incremental risk.

An authenticated non-admin Open WebUI user who holds read access to an arena wrapper model crafts a POST request to /api/v1/tasks/moa/completions referencing the wrapper model ID. The task endpoint's direct code path passes the wrapper access check, then resolves arena fallback and recurses with bypass_filter=True, silently elevating access to a restricted backend model (such as a premium or governance-controlled LLM) without triggering the submodel authorization gate. No public exploit code has been identified at time of analysis.