github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-05-07 03:18:23 -05:00
Code Issues 1.3k Packages Projects Releases 126 Wiki Activity

llm whitelist via api not working #1890

New Issue
Closed
opened 2025-11-11 14:55:46 -06:00 by GiteaMirror · 1 comment
GiteaMirror commented 2025-11-11 14:55:46 -06:00
Owner
Copy Link

Originally created by @kivi280 on GitHub (Aug 26, 2024).

Bug Report

Installation Method

docker run -d -p 3000:8080 --gpus=all -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollama

Environment

  • Open WebUI Version: v0.3.11

  • Ollama (if applicable): v0.3.4

  • Operating System: Ubuntu 22.04.4 LTS

Confirmation:

  • I have read and followed all the instructions provided in the README.md.
  • I am on the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.

Expected Behavior:

Users with the “user"-authorization can only access the LLMs via the API that have been added to the whitelist.

Actual Behavior:

All users can access all pulled LLMs, even those that are not in the whitelist

Description

Bug Summary:
All users can use all LLMs, even those that are not in the whitelist.

Reproduction Details

Steps to Reproduce:

as Admin:

  • add User with user role
  • pull two llms but only whitelist one of them

as User:

  • create API key
  • create API request with own API Key. (tested with thunder client in vs code)
    • Use as model the LLM which is not in the whitelist
  • check the response

Logs and Screenshots

Screenshots/Screen Recordings (if applicable):
whitelisted llm:
admin_model_settings
all pulled models:
admin_pulled_models
user api request body:
user_api_request_body
api response:
user_api_response
available llms via frontend:
user_available_frontend_llms

Originally created by @kivi280 on GitHub (Aug 26, 2024). # Bug Report ## Installation Method docker run -d -p 3000:8080 --gpus=all -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollama ## Environment - **Open WebUI Version:** v0.3.11 - **Ollama (if applicable):** v0.3.4 - **Operating System:** Ubuntu 22.04.4 LTS **Confirmation:** - [x] I have read and followed all the instructions provided in the README.md. - [ ] I am on the latest version of both Open WebUI and Ollama. - [ ] I have included the browser console logs. - [ ] I have included the Docker container logs. - [x] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below. ## Expected Behavior: Users with the “user"-authorization can only access the LLMs via the API that have been added to the whitelist. ## Actual Behavior: All users can access all pulled LLMs, even those that are not in the whitelist ## Description **Bug Summary:** All users can use all LLMs, even those that are not in the whitelist. ## Reproduction Details **Steps to Reproduce:** as Admin: - add User with **user** role - pull two llms but only whitelist one of them as User: - create API key - create API request with own API Key. (tested with thunder client in vs code) - Use as model the LLM which is not in the whitelist - check the response ## Logs and Screenshots **Screenshots/Screen Recordings (if applicable):** whitelisted llm: ![admin_model_settings](https://github.com/user-attachments/assets/1055b544-2275-4fd3-a157-f38877d55692) all pulled models: ![admin_pulled_models](https://github.com/user-attachments/assets/3f121761-a0b0-4084-8324-3b10f248dbf4) user api request body: ![user_api_request_body](https://github.com/user-attachments/assets/9bb913b5-1c79-477b-83b6-023fd435ee96) api response: ![user_api_response](https://github.com/user-attachments/assets/e8cdc823-2ae6-41d9-aa4c-6f94c3d00a29) available llms via frontend: ![user_available_frontend_llms](https://github.com/user-attachments/assets/6fc9840e-38af-486b-b985-5473b00be34d)
GiteaMirror commented 2025-11-11 14:55:47 -06:00
Author
Owner
Copy Link

@tjbck commented on GitHub (Aug 26, 2024):

Fixed on dev, testing wanted here!

@tjbck commented on GitHub (Aug 26, 2024): Fixed on dev, testing wanted here!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#1890
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?