Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

14808 vulnerabilities reference this CWE, most recent first.

GHSA-RCMC-Q9RJ-4WMQ

Vulnerability from github – Published: 2026-06-01 14:23 – Updated: 2026-06-01 14:23
VLAI
Summary
praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}
Details

Summary

Type: Authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/{workspace_id} endpoint is gated only by require_workspace_member(workspace_id) (default min_role="member"). Any member can rewrite the workspace's name, description, and the settings JSON blob. The settings field is a free-form JSON object — depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. File: src/praisonai-platform/praisonai_platform/api/routes/workspaces.py, lines 63-74; services/workspace_service.py's update() method. Root cause: Depends(require_workspace_member) resolves to default min_role="member". WorkspaceService.update(workspace_id, name, description, settings) writes the new fields to the workspace row without any caller-permission check. The role hierarchy (MemberService.has_role) is never consulted.

Affected Code

File: src/praisonai-platform/praisonai_platform/api/routes/workspaces.py, lines 63-74.

@router.patch("/{workspace_id}", response_model=WorkspaceResponse)
async def update_workspace(
    workspace_id: str,
    body: WorkspaceUpdate,
    user: AuthIdentity = Depends(require_workspace_member),         # <-- BUG: defaults to min_role="member"
    session: AsyncSession = Depends(get_db),
):
    ws_svc = WorkspaceService(session)
    ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)  # <-- writes any value
    if ws is None:
        raise HTTPException(status_code=404, detail="Workspace not found")
    return WorkspaceResponse.model_validate(ws)

Why it's wrong: workspace name and settings are owner-tier fields. Renaming the workspace to a profanity is a low-impact griefing vector; rewriting the JSON settings blob is potentially a much higher-impact configuration injection (depending on what fields downstream code reads from settings, the attacker may flip feature flags, redirect webhook URLs, change LLM provider keys for shared configs, disable audit logging, etc.). The require_workspace_member(min_role) parameter is implemented and unused. This endpoint should require owner.

Exploit Chain

  1. Attacker is a member of workspace W with role "member". State: attacker holds JWT.
  2. Attacker sends PATCH /workspaces/W with Authorization: Bearer <attacker_jwt> and body {"name": "Compromised", "description": "Owned by attacker", "settings": {"allow_public_invite": true, "ai_provider_url": "https://attacker.example/v1"}}. State: control flow enters update_workspace.
  3. require_workspace_member(W, attacker) passes. WorkspaceService.update(W, ...) writes the three fields. State: workspace W now has attacker-chosen name, description, and settings.
  4. The settings JSON is read by any downstream code that consults workspace settings (LLM proxying, invite flows, webhook routing). If the deployment uses settings-keyed configuration overrides, those overrides now point at attacker-controlled endpoints.
  5. Final state: with one member-level token plus one PATCH, the attacker rewrites the workspace's metadata and settings, with effects ranging from cosmetic (rename) to substantive (settings-keyed config injection).

Security Impact

Severity: sec-moderate. CVSS 6.5: network attack, low complexity, low privileges, no user interaction, scope unchanged, no confidentiality directly (though settings rewrites may enable indirect data exfiltration via attacker-pointed integration URLs), high integrity, no availability claim. Attacker capability: rewrite any workspace's name, description, and settings JSON. The actual blast radius depends on what fields the deployment reads from settings — but that field is documented as a free-form JSON blob, so any future configuration the platform adds there becomes attacker-tunable. Preconditions: praisonai-platform is deployed multi-tenant; attacker has any membership token in the target workspace. Differential: source-inspection-verified. With the suggested fix below, member-tier tokens fail the gate and the metadata rewrite is rejected with 403.

Suggested Fix

--- a/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py
+++ b/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py
@@ -63,11 +63,11 @@
 @router.patch("/{workspace_id}", response_model=WorkspaceResponse)
 async def update_workspace(
     workspace_id: str,
     body: WorkspaceUpdate,
-    user: AuthIdentity = Depends(require_workspace_member),
+    user: AuthIdentity = Depends(_require_workspace_owner),  # see member-update-role advisory for helper
     session: AsyncSession = Depends(get_db),
 ):
     ws_svc = WorkspaceService(session)
     ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)
     if ws is None:
         raise HTTPException(status_code=404, detail="Workspace not found")
     return WorkspaceResponse.model_validate(ws)

Defence-in-depth: validate the keys allowed in body.settings against an allowlist so the field cannot become an arbitrary config-injection primitive even for owners. The four companion workspace-mutation endpoints (add_member, update_member_role, remove_member, delete_workspace) exhibit the same default-min-role gap and are filed as their own advisories.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47411"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-01T14:23:08Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n**Type:** Authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role=\"member\"`). Any member can rewrite the workspace\u0027s `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object \u2014 depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there.\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/workspaces.py`, lines 63-74; `services/workspace_service.py`\u0027s `update()` method.\n**Root cause:** `Depends(require_workspace_member)` resolves to default `min_role=\"member\"`. `WorkspaceService.update(workspace_id, name, description, settings)` writes the new fields to the workspace row without any caller-permission check. The role hierarchy (`MemberService.has_role`) is never consulted.\n\n## Affected Code\n\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/workspaces.py`, lines 63-74.\n\n```python\n@router.patch(\"/{workspace_id}\", response_model=WorkspaceResponse)\nasync def update_workspace(\n    workspace_id: str,\n    body: WorkspaceUpdate,\n    user: AuthIdentity = Depends(require_workspace_member),         # \u003c-- BUG: defaults to min_role=\"member\"\n    session: AsyncSession = Depends(get_db),\n):\n    ws_svc = WorkspaceService(session)\n    ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)  # \u003c-- writes any value\n    if ws is None:\n        raise HTTPException(status_code=404, detail=\"Workspace not found\")\n    return WorkspaceResponse.model_validate(ws)\n```\n\n**Why it\u0027s wrong:** workspace name and settings are owner-tier fields. Renaming the workspace to a profanity is a low-impact griefing vector; rewriting the JSON `settings` blob is potentially a much higher-impact configuration injection (depending on what fields downstream code reads from `settings`, the attacker may flip feature flags, redirect webhook URLs, change LLM provider keys for shared configs, disable audit logging, etc.). The `require_workspace_member(min_role)` parameter is implemented and unused. This endpoint should require owner.\n\n## Exploit Chain\n\n1. Attacker is a member of workspace `W` with role \"member\". State: attacker holds JWT.\n2. Attacker sends `PATCH /workspaces/W` with `Authorization: Bearer \u003cattacker_jwt\u003e` and body `{\"name\": \"Compromised\", \"description\": \"Owned by attacker\", \"settings\": {\"allow_public_invite\": true, \"ai_provider_url\": \"https://attacker.example/v1\"}}`. State: control flow enters `update_workspace`.\n3. `require_workspace_member(W, attacker)` passes. `WorkspaceService.update(W, ...)` writes the three fields. State: workspace `W` now has attacker-chosen name, description, and settings.\n4. The settings JSON is read by any downstream code that consults workspace settings (LLM proxying, invite flows, webhook routing). If the deployment uses settings-keyed configuration overrides, those overrides now point at attacker-controlled endpoints.\n5. Final state: with one member-level token plus one PATCH, the attacker rewrites the workspace\u0027s metadata and settings, with effects ranging from cosmetic (rename) to substantive (settings-keyed config injection).\n\n## Security Impact\n\n**Severity:** sec-moderate. CVSS 6.5: network attack, low complexity, low privileges, no user interaction, scope unchanged, no confidentiality directly (though settings rewrites may enable indirect data exfiltration via attacker-pointed integration URLs), high integrity, no availability claim.\n**Attacker capability:** rewrite any workspace\u0027s name, description, and settings JSON. The actual blast radius depends on what fields the deployment reads from `settings` \u2014 but that field is documented as a free-form JSON blob, so any future configuration the platform adds there becomes attacker-tunable.\n**Preconditions:** `praisonai-platform` is deployed multi-tenant; attacker has any membership token in the target workspace.\n**Differential:** source-inspection-verified. With the suggested fix below, member-tier tokens fail the gate and the metadata rewrite is rejected with 403.\n\n## Suggested Fix\n\n```diff\n--- a/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py\n+++ b/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py\n@@ -63,11 +63,11 @@\n @router.patch(\"/{workspace_id}\", response_model=WorkspaceResponse)\n async def update_workspace(\n     workspace_id: str,\n     body: WorkspaceUpdate,\n-    user: AuthIdentity = Depends(require_workspace_member),\n+    user: AuthIdentity = Depends(_require_workspace_owner),  # see member-update-role advisory for helper\n     session: AsyncSession = Depends(get_db),\n ):\n     ws_svc = WorkspaceService(session)\n     ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)\n     if ws is None:\n         raise HTTPException(status_code=404, detail=\"Workspace not found\")\n     return WorkspaceResponse.model_validate(ws)\n```\n\nDefence-in-depth: validate the keys allowed in `body.settings` against an allowlist so the field cannot become an arbitrary config-injection primitive even for owners. The four companion workspace-mutation endpoints (`add_member`, `update_member_role`, `remove_member`, `delete_workspace`) exhibit the same default-min-role gap and are filed as their own advisories.",
  "id": "GHSA-rcmc-q9rj-4wmq",
  "modified": "2026-06-01T14:23:08Z",
  "published": "2026-06-01T14:23:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rcmc-q9rj-4wmq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}"
}

GHSA-RCQF-RGP8-QR4J

Vulnerability from github – Published: 2024-11-28 06:32 – Updated: 2024-11-28 06:32
VLAI
Details

The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iat_add_alt_txt_action and iat_update_alt_txt_action AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the alt text on arbitrary images.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-11918"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-28T06:15:08Z",
    "severity": "MODERATE"
  },
  "details": "The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iat_add_alt_txt_action and iat_update_alt_txt_action AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the alt text on arbitrary images.",
  "id": "GHSA-rcqf-rgp8-qr4j",
  "modified": "2024-11-28T06:32:43Z",
  "published": "2024-11-28T06:32:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11918"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3188755%40image-alt-text\u0026new=3188755%40image-alt-text\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22143fe3-e599-4b44-99c0-ba66d88ff5d6?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RCQP-HX94-8H2W

Vulnerability from github – Published: 2025-05-16 18:31 – Updated: 2026-04-01 18:35
VLAI
Details

Missing Authorization vulnerability in Ashan Perera EventON allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EventON: from n/a through 2.4.4.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-48116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-16T16:15:43Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Ashan Perera EventON allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EventON: from n/a through 2.4.4.",
  "id": "GHSA-rcqp-hx94-8h2w",
  "modified": "2026-04-01T18:35:07Z",
  "published": "2025-05-16T18:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48116"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/eventon-lite/vulnerability/wordpress-eventon-2-4-4-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RCQQ-5H75-3J53

Vulnerability from github – Published: 2023-02-28 15:30 – Updated: 2026-04-08 18:32
VLAI
Details

The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to update google analytics options maintained by the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-1022"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-28T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to update google analytics options maintained by the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.",
  "id": "GHSA-rcqq-5h75-3j53",
  "modified": "2026-04-08T18:32:02Z",
  "published": "2023-02-28T15:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1022"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2870465/wp-meta-seo/trunk?contextall=1\u0026old=2869205\u0026old_path=%2Fwp-meta-seo%2Ftrunk#file2"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2870465%40wp-meta-seo\u0026new=2870465%40wp-meta-seo\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/702f9d3b-5d33-4215-ac76-9aae3162d775"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/702f9d3b-5d33-4215-ac76-9aae3162d775?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RCRR-P232-7F6X

Vulnerability from github – Published: 2023-12-08 18:30 – Updated: 2023-12-13 00:30
VLAI
Details

In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-48402"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-08T16:15:16Z",
    "severity": "HIGH"
  },
  "details": "In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n",
  "id": "GHSA-rcrr-p232-7f6x",
  "modified": "2023-12-13T00:30:33Z",
  "published": "2023-12-08T18:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48402"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2023-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RCRV-6R7R-RR7M

Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2024-01-30 21:43
VLAI
Summary
Missing permission check in Jenkins FTP publisher Plugin
Details

A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jvnet.hudson.plugins:ftppublisher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-1003059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T21:43:50Z",
    "nvd_published_at": "2019-04-04T16:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.",
  "id": "GHSA-rcrv-6r7r-rr7m",
  "modified": "2024-01-30T21:43:50Z",
  "published": "2022-05-13T01:17:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003059"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107790"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Missing permission check in Jenkins FTP publisher Plugin"
}

GHSA-RCVP-6FGW-C7FH

Vulnerability from github – Published: 2026-05-08 19:52 – Updated: 2026-05-15 23:53
VLAI
Summary
Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show
Details

Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Affected Component

Ollama proxy endpoints missing model access control: - backend/open_webui/routers/ollama.py (lines 955-995, generate_completion) - backend/open_webui/routers/ollama.py (lines 835-881, embed) - backend/open_webui/routers/ollama.py (lines 891-937, embeddings) - backend/open_webui/routers/ollama.py (lines 791-820, show_model_info)

Affected Versions

Current main branch (commit 6fdd19bf1) and likely all versions with Ollama model access control support.

Description

Four Ollama proxy endpoints accept any model name from the user and forward the request to the Ollama backend without checking whether the user is authorized to access that model. These endpoints only require get_verified_user (any authenticated non-pending user) and validate that the model exists in the full unfiltered model list, but never check AccessGrants.has_access().

This is in direct contrast with the /ollama/api/chat endpoint (line 1101-1122) which correctly validates model access grants and returns 403 for unauthorized users:

# /api/chat (line 1101-1122) — CORRECTLY checks access
if not bypass_filter and user.role == 'user':
    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
    if not (
        user.id == model_info.user_id
        or AccessGrants.has_access(
            user_id=user.id, resource_type='model',
            resource_id=model_info.id, permission='read',
            user_group_ids=user_group_ids,
        )
    ):
        raise HTTPException(status_code=403, detail='Model not found')

# /api/generate (line 955-995) — NO access check at all
# /api/embed (line 835-881) — NO access check at all
# /api/embeddings (line 891-937) — NO access check at all
# /api/show (line 791-820) — NO access check at all

CVSS 3.1 Breakdown

Metric Value Rationale
Attack Vector Network (N) Exploited remotely via API calls
Attack Complexity Low (L) Single API call with a known model name
Privileges Required Low (L) Requires any authenticated user account
User Interaction None (N) No victim interaction required
Scope Unchanged (U) Impact within the Ollama model access boundary
Confidentiality Low (L) /api/show exposes restricted model details including system prompts and parameters
Integrity None (N) No data modification
Availability Low (L) Unauthorized consumption of GPU/compute resources on restricted models

Attack Scenario

  1. Admin configures model access control, restricting llama3:70b to the "ML Engineers" group. Regular user Alice is only authorized for llama3:8b.
  2. Alice knows the restricted model name (model names are predictable — llama3:70b, mistral:latest, etc.).
  3. Alice calls the unprotected endpoints directly: ```bash # Run completions on restricted model curl -X POST /ollama/api/generate \ -H "Authorization: Bearer " \ -d '{"model": "llama3:70b", "prompt": "..."}'

# View restricted model details and system prompt curl -X POST /ollama/api/show \ -H "Authorization: Bearer " \ -d '{"model": "llama3:70b"}'

# Generate embeddings with restricted model curl -X POST /ollama/api/embed \ -H "Authorization: Bearer " \ -d '{"model": "llama3:70b", "input": "..."}' ``` 4. All requests succeed and are proxied to Ollama without any access control check.

Impact

  • Model access control is silently ineffective for four out of five Ollama proxy endpoints
  • Unauthorized users can consume GPU/compute resources on restricted models (cost and capacity impact in multi-user deployments)
  • /api/show exposes restricted model configurations including system prompts, parameters, templates, and license information
  • Admins have a false sense of security — access restrictions appear to work via the main chat interface but are trivially bypassed via direct API calls

Preconditions

  • Ollama must be configured as a backend
  • Admin must have configured model access control (not using BYPASS_MODEL_ACCESS_CONTROL=true)
  • Attacker must know the restricted model name (model names follow predictable conventions)
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.12"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44563"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T19:52:42Z",
    "nvd_published_at": "2026-05-15T20:16:48Z",
    "severity": "MODERATE"
  },
  "details": "# Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show\n\n## Affected Component\n\nOllama proxy endpoints missing model access control:\n- `backend/open_webui/routers/ollama.py` (lines 955-995, `generate_completion`)\n- `backend/open_webui/routers/ollama.py` (lines 835-881, `embed`)\n- `backend/open_webui/routers/ollama.py` (lines 891-937, `embeddings`)\n- `backend/open_webui/routers/ollama.py` (lines 791-820, `show_model_info`)\n\n## Affected Versions\n\nCurrent main branch (commit `6fdd19bf1`) and likely all versions with Ollama model access control support.\n\n## Description\n\nFour Ollama proxy endpoints accept any model name from the user and forward the request to the Ollama backend without checking whether the user is authorized to access that model. These endpoints only require `get_verified_user` (any authenticated non-pending user) and validate that the model exists in the full unfiltered model list, but never check `AccessGrants.has_access()`.\n\nThis is in direct contrast with the `/ollama/api/chat` endpoint (line 1101-1122) which correctly validates model access grants and returns 403 for unauthorized users:\n\n```python\n# /api/chat (line 1101-1122) \u2014 CORRECTLY checks access\nif not bypass_filter and user.role == \u0027user\u0027:\n    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}\n    if not (\n        user.id == model_info.user_id\n        or AccessGrants.has_access(\n            user_id=user.id, resource_type=\u0027model\u0027,\n            resource_id=model_info.id, permission=\u0027read\u0027,\n            user_group_ids=user_group_ids,\n        )\n    ):\n        raise HTTPException(status_code=403, detail=\u0027Model not found\u0027)\n\n# /api/generate (line 955-995) \u2014 NO access check at all\n# /api/embed (line 835-881) \u2014 NO access check at all\n# /api/embeddings (line 891-937) \u2014 NO access check at all\n# /api/show (line 791-820) \u2014 NO access check at all\n```\n\n## CVSS 3.1 Breakdown\n\n| Metric | Value | Rationale |\n|--------|-------|-----------|\n| Attack Vector | Network (N) | Exploited remotely via API calls |\n| Attack Complexity | Low (L) | Single API call with a known model name |\n| Privileges Required | Low (L) | Requires any authenticated user account |\n| User Interaction | None (N) | No victim interaction required |\n| Scope | Unchanged (U) | Impact within the Ollama model access boundary |\n| Confidentiality | Low (L) | `/api/show` exposes restricted model details including system prompts and parameters |\n| Integrity | None (N) | No data modification |\n| Availability | Low (L) | Unauthorized consumption of GPU/compute resources on restricted models |\n\n## Attack Scenario\n\n1. Admin configures model access control, restricting `llama3:70b` to the \"ML Engineers\" group. Regular user Alice is only authorized for `llama3:8b`.\n2. Alice knows the restricted model name (model names are predictable \u2014 `llama3:70b`, `mistral:latest`, etc.).\n3. Alice calls the unprotected endpoints directly:\n   ```bash\n   # Run completions on restricted model\n   curl -X POST /ollama/api/generate \\\n     -H \"Authorization: Bearer \u003calice_token\u003e\" \\\n     -d \u0027{\"model\": \"llama3:70b\", \"prompt\": \"...\"}\u0027\n\n   # View restricted model details and system prompt\n   curl -X POST /ollama/api/show \\\n     -H \"Authorization: Bearer \u003calice_token\u003e\" \\\n     -d \u0027{\"model\": \"llama3:70b\"}\u0027\n\n   # Generate embeddings with restricted model\n   curl -X POST /ollama/api/embed \\\n     -H \"Authorization: Bearer \u003calice_token\u003e\" \\\n     -d \u0027{\"model\": \"llama3:70b\", \"input\": \"...\"}\u0027\n   ```\n4. All requests succeed and are proxied to Ollama without any access control check.\n\n## Impact\n\n- Model access control is silently ineffective for four out of five Ollama proxy endpoints\n- Unauthorized users can consume GPU/compute resources on restricted models (cost and capacity impact in multi-user deployments)\n- `/api/show` exposes restricted model configurations including system prompts, parameters, templates, and license information\n- Admins have a false sense of security \u2014 access restrictions appear to work via the main chat interface but are trivially bypassed via direct API calls\n\n## Preconditions\n\n- Ollama must be configured as a backend\n- Admin must have configured model access control (not using `BYPASS_MODEL_ACCESS_CONTROL=true`)\n- Attacker must know the restricted model name (model names follow predictable conventions)",
  "id": "GHSA-rcvp-6fgw-c7fh",
  "modified": "2026-05-15T23:53:14Z",
  "published": "2026-05-08T19:52:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-rcvp-6fgw-c7fh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44563"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI\u0027s Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show"
}

GHSA-RCW6-V8GJ-MX3J

Vulnerability from github – Published: 2025-11-04 15:31 – Updated: 2025-11-05 17:48
VLAI
Details

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarDenunciasById.php'.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-41345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-04T14:15:36Z",
    "severity": "HIGH"
  },
  "details": "A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users\u0027 information by sending a POST through the\u00a0parameters \u0027id_denuncia\u0027 and \u0027id_user\u0027 in \u0027/backend/api/buscarDenunciasById.php\u0027.",
  "id": "GHSA-rcw6-v8gj-mx3j",
  "modified": "2025-11-05T17:48:28Z",
  "published": "2025-11-04T15:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41345"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-RF26-7HF8-JJ9C

Vulnerability from github – Published: 2026-07-23 12:32 – Updated: 2026-07-23 12:32
VLAI
Details

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-65537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-23T12:18:46Z",
    "severity": "MODERATE"
  },
  "details": "Subscriber Broken Access Control in Cyr to Lat reloaded \u2013 transliteration of links and file names \u003c= 1.3.3 versions.",
  "id": "GHSA-rf26-7hf8-jj9c",
  "modified": "2026-07-23T12:32:30Z",
  "published": "2026-07-23T12:32:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65537"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/cyr-and-lat/vulnerability/wordpress-cyr-to-lat-reloaded-transliteration-of-links-and-file-names-plugin-1-3-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RF35-M962-38XM

Vulnerability from github – Published: 2026-01-14 06:30 – Updated: 2026-01-14 06:30
VLAI
Details

The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple functions in all versions up to, and including, 1.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings including disabling auto-compression and changing image quality settings.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-14482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-14T06:15:52Z",
    "severity": "MODERATE"
  },
  "details": "The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple functions in all versions up to, and including, 1.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings including disabling auto-compression and changing image quality settings.",
  "id": "GHSA-rf35-m962-38xm",
  "modified": "2026-01-14T06:30:24Z",
  "published": "2026-01-14T06:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14482"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/crush-pics/trunk/inc/class-ajax.php#L193"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/crush-pics/trunk/inc/class-ajax.php#L30"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/crush-pics/trunk/inc/class-ajax.php#L66"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e71bf15-aee0-4efc-a1c6-faad9f6e4f38?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list