Installed latest release as of writing (0.5.6) via docker via WSL2.
Environment
Open WebUI Version: 0.5.6
Operating System: Windows 11 (WSL2 - Ubuntu 22.04)
Confirmation:
I have read and followed all the instructions provided in the README.md.
I am on the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.
Expected Behavior:
Users without write access to a model should not be able to update it with POST /models/model/update?id=<model_id> method
Actual Behavior:
Any verified user regardless of their access rights can update any model, given that they know the model id
Any verified user can modify fields declared in ModelForm for the model resource (with the exception of id) & thus bypass access control checks
Description
Bug Summary:
A potentially major authorization issue is present in OUI.
Any verified user can update a model resource, given that they know its identifier, regardless of its access rights. Access control checks for models are mostly used for read permissions and not for write permissions. Additionally, many access control checks are performed on the client side.
Currently, this vulnerability is partially mitigated by the user not knowing the model's ID themselves (Security through Obscurity). However, proper access control checks should exist, especially when read/write permissions are considered separate (e.g., for accessing models via user groups).
This method can also be used to bypass other model updates that have stricter access control checks.
For example, the POST - /models/model/toggle endpoint requires certain access rights to toggle the model, but this can be bypassed with the /model/update endpoint since the ModelForm allows updating it. The update also does not update the "updated_at" timestamp.
Reproduction Details
Two users exist in the system - one with admin role & one with user
A private model exists which the user has either:
A) No access to (no group access)
B) Read access but no write access (via group)
User has gained or has previous knowledge of the model's unique identifier
User makes a POST call to /models/model/update?id=<model_id>. The body could contain updates to model's:
Name or description
Params, config & capabilities
Visibility (is_access)
Overwritten access control rights
The update succeeds
Logs and Screenshots
N/A
Additional Information
Proposal is to mitigate this issue by:
Add access control checks to model update endpoint
Restrict the access to update certain fields which are already handled by other endpoints (e.g. model/toggle)
Limit changes to access control to authorized users only.
Originally created by @antpyykk-kone on GitHub (Jan 23, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/8808
## Installation Method
Installed latest release as of writing (0.5.6) via docker via WSL2.
## Environment
- **Open WebUI Version:** 0.5.6
- **Operating System:** Windows 11 (WSL2 - Ubuntu 22.04)
**Confirmation:**
- [x] I have read and followed all the instructions provided in the README.md.
- [x] I am on the latest version of both Open WebUI and Ollama.
- [ ] I have included the browser console logs.
- [ ] I have included the Docker container logs.
- [x] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.
## Expected Behavior:
- Users without write access to a model should not be able to update it with `POST /models/model/update?id=<model_id>` method
## Actual Behavior:
- Any verified user regardless of their access rights can update any model, given that they know the model id
- Any verified user can modify fields declared in [ModelForm](https://github.com/open-webui/open-webui/blob/6c8d68b6fc4ba25f02627c21552a726c0bd2b36e/backend/open_webui/models/models.py#L135C1-L142C27 ) for the model resource (with the exception of id) & thus bypass access control checks
## Description
**Bug Summary:**
A potentially major authorization issue is present in OUI.
Any verified user can update a model resource, given that they know its identifier, regardless of its access rights. Access control checks for models are mostly used for read permissions and not for write permissions. Additionally, many access control checks are performed on the client side.
Currently, this vulnerability is partially mitigated by the user not knowing the model's ID themselves (Security through Obscurity). However, proper access control checks should exist, especially when read/write permissions are considered separate (e.g., for accessing models via user groups).
This method can also be used to bypass other model updates that have stricter access control checks.
For example, the [POST - /models/model/toggle](https://github.com/open-webui/open-webui/blob/6c8d68b6fc4ba25f02627c21552a726c0bd2b36e/backend/open_webui/routers/models.py#L109C1-L118C50) endpoint requires certain access rights to toggle the model, but this can be bypassed with the /model/update endpoint since the [ModelForm allows updating it](https://github.com/open-webui/open-webui/blob/6c8d68b6fc4ba25f02627c21552a726c0bd2b36e/backend/open_webui/models/models.py#L135C1-L142C27). The update also does not update the "updated_at" timestamp.
## Reproduction Details
1. Two users exist in the system - one with admin role & one with user
2. A private model exists which the user has either:
- A) No access to (no group access)
- B) Read access but no write access (via group)
3. User has gained or has previous knowledge of the model's unique identifier
4. User makes a POST call to `/models/model/update?id=<model_id>`. The body could contain updates to model's:
- Name or description
- Params, config & capabilities
- Visibility (is_access)
- Overwritten access control rights
5. The update succeeds
## Logs and Screenshots
N/A
## Additional Information
Proposal is to mitigate this issue by:
1. Add access control checks to model update endpoint
2. Restrict the access to update certain fields which are already handled by other endpoints (e.g. `model/toggle`)
3. Limit changes to access control to authorized users only.
I think a temporary fix for anyone affected by this could be to restrict the API endpoints to just harmless endpoints like this /api/chat/completions using the environment variable
But yes, in the default config, this should not be allowed, as the user does/should not have access to the admin panel and modifying the models like that, so it also shouldn't be possible via the API
<!-- gh-comment-id:2609538991 -->
@Classic298 commented on GitHub (Jan 23, 2025):
I think a temporary fix for anyone affected by this could be to restrict the API endpoints to just harmless endpoints like this /api/chat/completions using the environment variable
ENABLE_API_KEY_ENDPOINT_RESTRICTION=True
API_KEY_ALLOWED_ENDPOINTS=/api/chat/completions
But yes, in the default config, this should not be allowed, as the user does/should not have access to the admin panel and modifying the models like that, so it also shouldn't be possible via the API
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @antpyykk-kone on GitHub (Jan 23, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/8808
Installation Method
Installed latest release as of writing (0.5.6) via docker via WSL2.
Environment
Confirmation:
Expected Behavior:
POST /models/model/update?id=<model_id>methodActual Behavior:
Description
Bug Summary:
A potentially major authorization issue is present in OUI.
Any verified user can update a model resource, given that they know its identifier, regardless of its access rights. Access control checks for models are mostly used for read permissions and not for write permissions. Additionally, many access control checks are performed on the client side.
Currently, this vulnerability is partially mitigated by the user not knowing the model's ID themselves (Security through Obscurity). However, proper access control checks should exist, especially when read/write permissions are considered separate (e.g., for accessing models via user groups).
This method can also be used to bypass other model updates that have stricter access control checks.
For example, the POST - /models/model/toggle endpoint requires certain access rights to toggle the model, but this can be bypassed with the /model/update endpoint since the ModelForm allows updating it. The update also does not update the "updated_at" timestamp.
Reproduction Details
/models/model/update?id=<model_id>. The body could contain updates to model's:Logs and Screenshots
N/A
Additional Information
Proposal is to mitigate this issue by:
model/toggle)@Classic298 commented on GitHub (Jan 23, 2025):
I think a temporary fix for anyone affected by this could be to restrict the API endpoints to just harmless endpoints like this /api/chat/completions using the environment variable
ENABLE_API_KEY_ENDPOINT_RESTRICTION=True
API_KEY_ALLOWED_ENDPOINTS=/api/chat/completions
But yes, in the default config, this should not be allowed, as the user does/should not have access to the admin panel and modifying the models like that, so it also shouldn't be possible via the API
@tjbck commented on GitHub (Jan 23, 2025):
Addressed with
dd6de749d5@antpyykk-kone commented on GitHub (Jan 24, 2025):
Thank you for your fast action