# Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Open WebUI never re-checks access on a chained base_model_id, so any user can wrap a restricted model and query it with the admin's API key.

- Payout: Research
- Severity: high
- Program: Open WebUI
- Found by: Classic298
- Disclosed: 2026-05-08
- CVE: CVE-2026-44555
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-9vvh-qmjx-p4q8
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-9vvh-qmjx-p4q8
- Tags: area:ai domain:ai domain:web impact:integrity impact:internal-access kind:research platform:ghsa sev:high tech:llm tech:python technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Model creation/import and chat completion endpoints (base_model_id chaining)
**Root cause:** check_model_access only validates the user-facing model, not the resolved base_model_id; create/import endpoints accept arbitrary base_model_id without verifying caller access to it.
**Steps:**
1. Attacker with default workspace.models permission calls `POST /api/v1/models/create` with `{"id": "cheap-assistant", "name": "Cheap Assistant", "base_model_id": "gpt-4-turbo-restricted", "params": {}, "meta": {}}`
2. Creation endpoint does not validate access to `gpt-4-turbo-restricted`; attacker owns the wrapper so access check passes
3. Send `POST /api/chat/completions` with `{"model": "cheap-assistant", "messages": [...]}`
4. main.py resolves base_model_id, rewrites `payload['model']` to `gpt-4-turbo-restricted`, dispatches upstream with admin API key
5. Attacker receives restricted model responses; same bypass via import endpoint, which can also overwrite existing models
**How found:** Code review of the model chaining path: noticed check_model_access at utils/models.py:380 runs only on the user-facing model while main.py:1696 resolves base_model_id without a corresponding access check.
**Exploitation:** Regular user creates a self-owned wrapper model pointing at a restricted base model, then queries the wrapper; server rewrites the payload to the base model ID and dispatches using the admin-configured backend API key, returning restricted responses to the attacker.
**Escalation:** Import endpoint variant additionally allows overwriting existing models (related ownership finding).
**Insight:** When a product supports composition/aliasing (base_model_id, wrappers, proxies), audit every resolution point where the alias is swapped for the real resource — authorization is often enforced only on the alias the user names.

## Proof of concept (copied exactly from the original report)

**Chat completion request invoking chained model**

```
POST /api/chat/completions
   {"model": "cheap-assistant", "messages": [...]}
```