llm whitelist via api not working #1890

New Issue

2025-11-11T14:55:46-06:00

GiteaMirror commented

2025-11-11 14:55:46 -06:00

Originally created by @kivi280 on GitHub (Aug 26, 2024).

Bug Report

Installation Method

docker run -d -p 3000:8080 --gpus=all -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollama

Environment

Open WebUI Version: v0.3.11
Ollama (if applicable): v0.3.4
Operating System: Ubuntu 22.04.4 LTS

Confirmation:

I have read and followed all the instructions provided in the README.md.
I am on the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.

Expected Behavior:

Users with the “user"-authorization can only access the LLMs via the API that have been added to the whitelist.

Actual Behavior:

All users can access all pulled LLMs, even those that are not in the whitelist

Description

Bug Summary:
All users can use all LLMs, even those that are not in the whitelist.

Reproduction Details

Steps to Reproduce:

as Admin:

add User with user role
pull two llms but only whitelist one of them

as User:

create API key
create API request with own API Key. (tested with thunder client in vs code)
- Use as model the LLM which is not in the whitelist
check the response

Logs and Screenshots

Screenshots/Screen Recordings (if applicable):
whitelisted llm:

all pulled models:

user api request body:

api response:

available llms via frontend:

Originally created by @kivi280 on GitHub (Aug 26, 2024). # Bug Report ## Installation Method docker run -d -p 3000:8080 --gpus=all -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollama ## Environment - **Open WebUI Version:** v0.3.11 - **Ollama (if applicable):** v0.3.4 - **Operating System:** Ubuntu 22.04.4 LTS **Confirmation:** - [x] I have read and followed all the instructions provided in the README.md. - [ ] I am on the latest version of both Open WebUI and Ollama. - [ ] I have included the browser console logs. - [ ] I have included the Docker container logs. - [x] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below. ## Expected Behavior: Users with the “user"-authorization can only access the LLMs via the API that have been added to the whitelist. ## Actual Behavior: All users can access all pulled LLMs, even those that are not in the whitelist ## Description **Bug Summary:** All users can use all LLMs, even those that are not in the whitelist. ## Reproduction Details **Steps to Reproduce:** as Admin: - add User with **user** role - pull two llms but only whitelist one of them as User: - create API key - create API request with own API Key. (tested with thunder client in vs code) - Use as model the LLM which is not in the whitelist - check the response ## Logs and Screenshots **Screenshots/Screen Recordings (if applicable):** whitelisted llm: ![admin_model_settings](https://github.com/user-attachments/assets/1055b544-2275-4fd3-a157-f38877d55692) all pulled models: ![admin_pulled_models](https://github.com/user-attachments/assets/3f121761-a0b0-4084-8324-3b10f248dbf4) user api request body: ![user_api_request_body](https://github.com/user-attachments/assets/9bb913b5-1c79-477b-83b6-023fd435ee96) api response: ![user_api_response](https://github.com/user-attachments/assets/e8cdc823-2ae6-41d9-aa4c-6f94c3d00a29) available llms via frontend: ![user_available_frontend_llms](https://github.com/user-attachments/assets/6fc9840e-38af-486b-b985-5473b00be34d)

GiteaMirror closed this issue

2025-11-11 14:55:46 -06:00

GiteaMirror commented

2025-11-11 14:55:47 -06:00