Description

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T21:17:26.480Z",
  "pubdate": "2026-09-04T21:17:26.480Z",
  "executiveSummary": "A critical missing authentication vulnerability exists in the freegpt-webui application, specifically within the Backend Conversation API component.\nThe vulnerability allows remote, unauthenticated attackers to interact with the conversation backend by manipulating the 'model' argument.\nThis flaw resides in the _conversation function located in server/backend.py.\nImpact includes unauthorized access to backend resources and potential manipulation of conversation flows, potentially bypassing intended security controls for model interaction.\nThe vulnerability affects versions up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.\nAs this product operates on a rolling release basis and is no longer supported by the maintainer, no official patch exists for these specific legacy versions.\nAttackers can trigger this remotely without pre-existing credentials, posing a significant risk of service abuse and unauthorized data access.",
  "technicalDetails": "The vulnerability originates in the _conversation function within server/backend.py, which serves as the primary endpoint for handling user-initiated conversations in the Backend Conversation API.\nThe root cause is an improper implementation of access control mechanisms where the application fails to validate the requester's authentication status before processing inputs for the 'model' parameter.\nBecause the input validation logic for the 'model' argument lacks server-side verification of a session token or user identity, an attacker can craft arbitrary HTTP requests that reach the backend logic directly.\nThe attack flow begins with the attacker identifying the target endpoint of the Backend Conversation API. By supplying a maliciously crafted 'model' argument in a POST request, the attacker bypasses the expected validation handshake.\nSince the _conversation function trusts the incoming request parameters without verifying the integrity of the user's authentication context, the backend proceeds to initialize the specified model interaction.\nThis behavior exposes the underlying infrastructure to unauthorized usage, as an attacker does not need to possess valid authentication tokens or cookies to interact with the API.\nThe exploitability is high because the vulnerability is reachable over the network and requires no specific privilege level, as the check itself is omitted. Once the request is accepted by the server, the application treats the unauthenticated command as a legitimate request, leading to potential exhaustion of backend resources or unauthorized interactions with external LLM providers configured in the backend.\nPost-exploitation impact includes the ability to conduct unauthorized conversations, potential exfiltration of chat context if the backend logs are accessible, or the redirection of API quotas to unauthorized third parties.\nThe issue is exacerbated by the lack of maintenance, meaning that any vulnerability found in the codebase at the specified commit hash will remain unfixed, as the project is no longer actively secured by the original developers."
}