GHSA-rjmp-vjf2-qf4g Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation
Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data ManipulationSummaryThe `POST /api/v1/evaluations/feedback` endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via `FeedbackForm`, which uses `model_config = ConfigDict(extra='allow')`. Due to an insecure dictionary merge order in `insert_new_feedback()`, an authenticated attacker can inject a `user_id` field in the request body that overwrites the server-derived value, creating feedback records attributed to any arbitrary user. This corrupts the model evaluation leaderboard (Elo ratings) and enables identity spoofing.DetailsThe vulnerability exists in two layers:1. Model Layer — Insecure Dict Merge Order**File:** `backend/open_webui/models/feedbacks.py`, lines 148–160In Python, when a dictionary literal contains duplicate keys, the **last value wins**. Since `**form_data.model_dump()` appears after `'user_id': user_id`, any `user_id` field in the form data overwrites the authenticated user's ID.2. Schema Layer — `extra='allow'` on Request Form**File:** `backend/open_webui/models/feedbacks.py`, line 106The `extra='allow'` config means Pydantic will accept and preserve any extra fields in the request body, including `user_id`, `id`, and `version`. These are then spread into the `FeedbackModel` constructor, overwriting server-set values.Contrast with Secure PatternOther models in the same codebase use the correct ordering. For example, `backend/open_webui/models/functions.py`, line 120:And `ModelForm` at `backend/open_webui/models/models.py` uses `extra='ignore'`, which is the strictest approach.Impact1. User Identity SpoofingAn attacker can create feedback records attributed to any user by specifying their `user_id`. The admin export endpoint (`GET /api/v1/evaluations/feedbacks/export`) and admin list (`GET /api/v1/evaluations/feedbacks/all`) will show the spoofed `user_id` as the feedback author.2. Model Evaluation Leaderboard ManipulationThe Elo rating system at `backend/open_webui/routers/evaluations.py` computes model rankings directly from feedback records. An attacker can inject fake rating feedback to:Artificially inflate ratings for a specific modelDeflate ratings for competitor modelsMake organizational model evaluation decisions unreliable3. Record ID ControlBy injecting a custom `id`, an attacker controls the UUID of the feedback record. While this won't overwrite existing records (primary key constraint), it enables predictable record IDs that could be useful in other attack chains.PoCSeverity**CVSS 3.1:** 5.4 (Medium) — `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`**Attack Vector:** Network**Attack Complexity:** Low**Privileges Required:** Low (any authenticated user)**User Interaction:** None**Impact:** Integrity (feedback data falsification) + limited Availability (leaderboard reliability)Suggested RemediationOption 1: Fix dict merge order (minimal fix)Option 2: Remove `extra='allow'` from FeedbackForm (recommended)Option 3: Explicit field assignment (most secure)Affected Versionsv0.9.2 (current latest, confirmed vulnerable)Likely all versions since feedback/evaluation feature was introducedReferencesPrior advisory: "Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts" (patched in v0.9.0) — same root cause class, different endpoint
CVSS v3.1 score: 5.4