[PR #23647] [CLOSED] fix: enforce per-model access on chained base models #50347

New Issue

GiteaMirror · 2026-04-30T03:01:33-05:00

GiteaMirror commented

2026-04-30 03:01:33 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23647
Author: @Classic298
Created: 4/12/2026
Status: ❌ Closed

Base: dev ← Head: fix/base-model-access-chain-bypass

📝 Commits (5)

ad6ea36 fix: enforce per-model access on chained base models
980dd21 fix: preserve HTTPException status in import_models and honor bypass flags in functions.py
e874469 fix: thread bypass flag into ollama.py secondary base-model checks
7a0fd37 fix: enforce base-model grants for admins and preserve 403 at dispatch
402881b fix: fold admin bypass into runtime base-model checks in openai/ollama

📊 Changes

6 files changed (+187 additions, -5 deletions)

View changed files

📝 backend/open_webui/functions.py (+9 -1)
📝 backend/open_webui/main.py (+22 -1)
📝 backend/open_webui/routers/models.py (+47 -1)
📝 backend/open_webui/routers/ollama.py (+37 -1)
📝 backend/open_webui/routers/openai.py (+17 -1)
📝 backend/open_webui/utils/access_control/__init__.py (+55 -0)

📄 Description

When a custom model declares base_model_id, the access check on the user-facing wrapper did not extend to the base it forwards to. A caller with read access to the wrapper (ownership or grant) could reach an upstream model they were not authorized for.

Add a helper that re-runs the model access check against the resolved base, and wire it in at two layers: upfront when persisting a chain (create/import/update) so callers cannot plant bases they cannot read, and at dispatch time in every chat completion router path so access revocations after chain creation are still honored.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23647 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 4/12/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix/base-model-access-chain-bypass` --- ### 📝 Commits (5) - [`ad6ea36`](https://github.com/open-webui/open-webui/commit/ad6ea3622e985f4dc867a591c4cc394c8a92d0e7) fix: enforce per-model access on chained base models - [`980dd21`](https://github.com/open-webui/open-webui/commit/980dd2141f535990749f9405d7fdcefe0bb5a7c9) fix: preserve HTTPException status in import_models and honor bypass flags in functions.py - [`e874469`](https://github.com/open-webui/open-webui/commit/e874469d0ffef6513fd5cd5fc9c63f910fe9a020) fix: thread bypass flag into ollama.py secondary base-model checks - [`7a0fd37`](https://github.com/open-webui/open-webui/commit/7a0fd37a6631f6e7fe9928a0053f571fb97186ca) fix: enforce base-model grants for admins and preserve 403 at dispatch - [`402881b`](https://github.com/open-webui/open-webui/commit/402881b621729630c13afe7f680dc4e51006ca1d) fix: fold admin bypass into runtime base-model checks in openai/ollama ### 📊 Changes **6 files changed** (+187 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/functions.py` (+9 -1) 📝 `backend/open_webui/main.py` (+22 -1) 📝 `backend/open_webui/routers/models.py` (+47 -1) 📝 `backend/open_webui/routers/ollama.py` (+37 -1) 📝 `backend/open_webui/routers/openai.py` (+17 -1) 📝 `backend/open_webui/utils/access_control/__init__.py` (+55 -0) </details> ### 📄 Description When a custom model declares base_model_id, the access check on the user-facing wrapper did not extend to the base it forwards to. A caller with read access to the wrapper (ownership or grant) could reach an upstream model they were not authorized for. Add a helper that re-runs the model access check against the resolved base, and wire it in at two layers: upfront when persisting a chain (create/import/update) so callers cannot plant bases they cannot read, and at dispatch time in every chat completion router path so access revocations after chain creation are still honored. ### Contributor License Agreement  - [x] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-30 03:01:33 -05:00

GiteaMirror closed this issue

2026-04-30 03:01:34 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#50347