CVE-2026-59225

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.12 through 0.9.x

Description An authenticated non-admin user with read access to an arena wrapper model can access a restricted underlying model. This occurs because task endpoints, such as '/api/v1/tasks/moa/completions', call the generate chat completion() function directly. In this execution path, the arena fallback resolution occurs after the initial wrapper access check and recurses with bypass filter=True, which skips the access check for the selected submodel.

Recommendations Update Open WebUI to version 0.10.0.