From 8becf9443e3473179eee62085a682929c162d447 Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Thu, 23 Jul 2026 18:23:24 +0200 Subject: [PATCH] fix: only admins may switch the global Automatic1111 checkpoint from image generation (#27244) The Automatic1111 branch of the image generation route called set_image_model whenever the request carried a model field. On this backend set_image_model is not request-scoped: it persists image_generation.model to the global configuration and posts the new sd_model_checkpoint to the shared server, because Automatic1111 holds a single checkpoint instance-wide. A non-admin holding features.image_generation could therefore change the instance-wide image model and the shared backend checkpoint for every user by sending a model on an ordinary generation request, even though the setting is otherwise managed only through the admin-only image configuration route and the frontend never sends this field. Gate the switch on an admin caller. A non-admin now generates on the currently configured checkpoint and the model field no longer mutates global state; admins retain per-request model switching here and through the image configuration route. Image editing is unaffected, as it selects its model per request without writing global configuration. --- backend/open_webui/routers/images.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/open_webui/routers/images.py b/backend/open_webui/routers/images.py index 78247c0b7e..d26734da64 100644 --- a/backend/open_webui/routers/images.py +++ b/backend/open_webui/routers/images.py @@ -785,7 +785,11 @@ async def image_generations( images.append({'url': url}) return images elif image_config.IMAGE_GENERATION_ENGINE == 'automatic1111' or image_config.IMAGE_GENERATION_ENGINE == '': - if form_data.model: + # Automatic1111 holds one checkpoint instance-wide, so set_image_model + # persists the global default and switches the shared backend. Only an + # admin may do that; a non-admin generates on the currently configured + # checkpoint. The model field is not a per-user selection on this backend. + if form_data.model and user.role == 'admin': await set_image_model(request, form_data.model) data = {