GHSA-9vvh-qmjx-p4q8 Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Base Model Routing Bypasses Access Control via Model ChainingAffected ComponentModel chaining via `base_model_id`:`backend/open_webui/routers/models.py` (lines 170-214, `create_new_model`)`backend/open_webui/routers/models.py` (lines 254-308, `import_models`)`backend/open_webui/main.py` (lines 1696-1711, base model resolution in chat completion)`backend/open_webui/routers/openai.py` (lines 1032-1037, base model payload rewrite)`backend/open_webui/routers/ollama.py` (lines 1086-1090, base model payload rewrite)`backend/open_webui/utils/models.py` (line 380, `check_model_access` — checks user-facing model only)Affected VersionsCurrent main branch (commit `6fdd19bf1`) and likely all versions with the model chaining (`base_model_id`) feature.DescriptionOpen WebUI supports model composition via `base_model_id`: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model.Additionally, the model creation and import endpoints accept arbitrary `base_model_id` values without checking that the caller has access to that base model. Combined, this allows any user with the default model creation permission to create a model that chains to a restricted base model — and then invoke it, causing the server to dispatch the request to the restricted base model using the admin-configured API key.Attack ScenarioAdmin provisions a premium/restricted model `gpt-4-turbo-restricted` and configures access grants so only the "ML Engineers" group can use it.Attacker (a regular user not in that group) calls:The creation endpoint does not validate the attacker's access to `gpt-4-turbo-restricted`.Attacker now owns `cheap-assistant`. `check_model_access(attacker, cheap-assistant)` passes trivially because they are the owner.Attacker sends:At `main.py:1696`, the pipeline resolves `cheap-assistant.base_model_id` to `gpt-4-turbo-restricted`, rewrites `payload["model"]` to the base model ID, and dispatches the upstream request with the admin-configured API key for the backend.The attacker receives responses from the restricted model, bypassing the access grant policy.The same bypass is available via the import endpoint, which additionally allows overwriting existing models (see related finding on model import ownership).ImpactRegular users can query restricted models by chaining through a self-owned wrapper modelAccess control on `gpt-4-turbo-restricted` (or equivalent paid/tiered/internal models) becomes silently ineffectiveDirect cost impact on pay-per-token backends (OpenAI, Anthropic, Azure) — the admin's API key is used for requests the admin intended to forbidCreates a false sense of security — the admin sees access restrictions work through the standard model selector but not through user-created chainsPreconditionsAttacker must have model creation permission (default `workspace.models` permission, granted to all users by default)A restricted base model must exist on the instance (the target of the chain)
CVSS v3.1 score: 7.6