CVE-2026-70484: Open WebUI Auth Bypass Vulnerability

CVE-2026-70484 Overview

CVE-2026-70484 is a missing authorization vulnerability [CWE-862] in Open WebUI, a self-hosted AI platform. The flaw affects versions from 0.7.0 up to 0.11.0. The legacy chat-completions feature block trusted a client-supplied image_generation flag without re-checking the features.image_generation permission enforced by the direct image routes and native function-calling path. Authenticated users whose image-generation permission had been revoked could still consume the operator's configured image provider through chat completions. This resulted in unauthorized use of API credits, provider quota consumption, and writing of generated files to operator storage. The issue is fixed in version 0.11.0.

Critical Impact
Authenticated users with revoked image-generation permissions can bypass access controls to consume operator-funded image provider resources and write files to operator storage.

Affected Products

Open WebUI versions 0.7.0 through 0.10.x
Deployments exposing the legacy chat-completions endpoint
Instances relying on features.image_generation permission enforcement

Discovery Timeline

2026-08-04 - CVE-2026-70484 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70484

Vulnerability Analysis

The vulnerability resides in the legacy chat-completions middleware inside backend/open_webui/utils/middleware.py. The handler inspected a client-supplied features object and invoked chat_image_generation_handler whenever features['image_generation'] was true. The middleware did not verify that the requesting user held the features.image_generation permission. Direct /images routes and the native function-calling path both enforced this permission, but the legacy path did not.

An authenticated user could craft a chat-completions request with the image_generation flag set even after an administrator revoked the permission. The server would then dispatch the request to the operator-configured image provider. This consumed paid API credits, filled provider quotas, and wrote generated artifacts to operator-controlled storage.

The patch introduces an explicit permission check using has_permission with the features.image_generation key, plus an admin role bypass. A parallel fix applies to the features.web_search flag on the same code path.

Root Cause

The legacy chat-features block trusted client input without server-side authorization. Permission enforcement was implemented on adjacent endpoints but omitted on the legacy path, creating an authorization gap classified under [CWE-862] Missing Authorization.

Attack Vector

A remote authenticated user sends a chat-completions request containing "features": {"image_generation": true} while operating with function_calling set to legacy. The server dispatches the request to the image provider without checking whether the caller still holds the required permission.

python

# Patch excerpt: backend/open_webui/utils/middleware.py
if 'image_generation' in features and features['image_generation']:
    # features is client-supplied; re-check the permission the direct /images routes enforce.
    if getattr(user, 'role', None) == 'admin' or await has_permission(
        getattr(user, 'id', ''),
        'features.image_generation',
        await Config.get('user.permissions'),
    ):
        # Skip forced image generation when native FC is enabled - model can use generate_image tool
        if metadata.get('params', {}).get('function_calling') == 'legacy':
            form_data = await chat_image_generation_handler(request, form_data, extra_params, user)

Source: GitHub commit 897d69a

Detection Methods for CVE-2026-70484

Indicators of Compromise

Chat-completions requests containing features.image_generation=true originating from user accounts whose permission was revoked.
Unexpected image artifacts written to operator storage attributed to non-privileged accounts.
Spikes in outbound calls to the configured image provider that do not correspond to requests through the direct /images routes.

Detection Strategies

Correlate application logs for calls into chat_image_generation_handler with the current permission state of the invoking user.
Alert on chat-completions payloads that set features.image_generation from users lacking the features.image_generation role permission.
Track image provider billing telemetry against expected per-user allocations and flag deviations.

Monitoring Recommendations

Enable verbose logging on Open WebUI middleware to capture the features object per request.
Monitor storage volumes for new image artifacts and reconcile filenames against authorized generators.
Review API provider dashboards for anomalous request patterns tied to the Open WebUI service account.

How to Mitigate CVE-2026-70484

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later, which enforces the permission check on the legacy chat-features block.
Audit user permission assignments and revoke features.image_generation from accounts that should not consume image provider quota.
Rotate image provider API keys if unauthorized consumption is suspected.

Patch Information

The fix is available in Open WebUI v0.11.0. See the GitHub Release v0.11.0, the GitHub Pull Request #26703, and the GitHub Security Advisory GHSA-g423-grf7-98rv. The patch adds explicit has_permission checks around chat_image_generation_handler and chat_web_search_handler invocations.

Workarounds

Disable the legacy function-calling mode by setting function_calling to the native path on all models until patching is complete.
Restrict access to the image provider integration at the network or API gateway layer to accounts that require it.
Impose per-user rate limits on chat-completions endpoints to cap potential quota abuse.

bash

# Upgrade Open WebUI via Docker to the patched release
docker pull ghcr.io/open-webui/open-webui:0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
    -p 3000:8080 \
    -v open-webui:/app/backend/data \
    ghcr.io/open-webui/open-webui:0.11.0