Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypass_filter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated user to append ?bypass_filter=true and bypass model access control checks to invoke admin-restricted models. This vulnerability is fixed in 0.8.11.
Affected products
openwebui: open webui
References2
- github.com/open-webui/open-webui/security/advisories/GHSA-v6qf-… ExploitPatchVendor Advisory
- github.com/open-webui/open-webui/security/advisories/GHSA-v6qf-… ExploitPatchVendor Advisory
Metrics
- CVSS 3.1
-
5.4
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 9 · as of 14 November 2026
- CWE
- CWE-285
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.