Ahkarl13

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.11.4 **Description** Authenticated users can access disabled model provider backends by providing an explicit backend index. This occurs on Ollama and OpenAI-compatible listing routes, where the index can be passed as a path segment or query parameter. This allows attackers to trigger requests that include configured API keys, read version strings, and enumerate connections. **Recommendations** Update to version 0.11.4 or later.