## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/24812 **Author:** [@emash](https://github.com/emash) **Created:** 5/16/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `patch-1` --- ### 📝 Commits (1) - [`f8ad862`](https://github.com/open-webui/open-webui/commit/f8ad86239d07feda0b7bc1fa931a6f85691a1e70) fix: secure /api/config metadata leak for unauthenticated requests ### 📊 Changes **1 file changed** (+22 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/main.py` (+22 -17) </details> ### 📄 Description  # Pull Request Checklist - [x] **Linked Issue/Discussion:** #23400 - [x] **Target branch:** Verify that the pull request targets the `dev` branch. - [x] **Description:** Concise description down below. - [x] **Changelog:** Added at the bottom. - [x] **Documentation:** N/A - [x] **Dependencies:** N/A - [x] **Testing:** Manually tested on Python 3.11 environment. - [x] **Agentic AI Code:** Human reviewed and manually tested. - [x] **Code review:** Performed self-review. - [x] **Design & Architecture:** Smart defaults. - [x] **Git Hygiene:** Atomic change. - [x] **Title Prefix:** **fix** # Changelog Entry ### Description - Fixed a Broken Access Control issue in `/api/config` where system metadata, `VERSION`, and full `features` dict were unconditionally sent to unauthenticated clients. ### Fixed - Restricted exposure of the environment configuration to authenticated users only, returning a minimal flat layout for anonymous requests while keeping the login form operational. ---  - [X] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror commented

2026-05-21 17:08:22 -05:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/24812
Author: @emash
Created: 5/16/2026
Status: ❌ Closed

Base: dev ← Head: patch-1

📝 Commits (1)

f8ad862 fix: secure /api/config metadata leak for unauthenticated requests

📊 Changes

1 file changed (+22 additions, -17 deletions)

View changed files

📝 backend/open_webui/main.py (+22 -17)

📄 Description

Pull Request Checklist

Linked Issue/Discussion: [PR #14149] [MERGED] fix: $i18n.t fix (#23400)
Target branch: Verify that the pull request targets the dev branch.
Description: Concise description down below.
Changelog: Added at the bottom.
Documentation: N/A
Dependencies: N/A
Testing: Manually tested on Python 3.11 environment.
Agentic AI Code: Human reviewed and manually tested.
Code review: Performed self-review.
Design & Architecture: Smart defaults.
Git Hygiene: Atomic change.
Title Prefix: fix

Changelog Entry

Description

Fixed a Broken Access Control issue in /api/config where system metadata, VERSION, and full features dict were unconditionally sent to unauthenticated clients.

Fixed

Restricted exposure of the environment configuration to authenticated users only, returning a minimal flat layout for anonymous requests while keeping the login form operational.

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

GiteaMirror added the pull-request label 2026-05-21 17:08:22 -05:00

GiteaMirror closed this issue

2026-05-21 17:08:30 -05:00

[PR #24812] [CLOSED] fix: secure /api/config metadata leak for unauthenticated requests #131529