CVE-2026-85702 in freegpt-webui
Summary
by MITRE • 09/04/2026
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This vulnerability only affects products that are no longer supported by the maintainer.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The identified security flaw resides within the backend conversation API of the freegpt-webui project, specifically affecting versions up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. The vulnerability is located in the _conversation function found within the server/backend.py file and stems from improper handling of the model argument passed by the client. This implementation error results in a critical authentication bypass, allowing an attacker to manipulate input parameters to circumvent intended access controls. Because the application operates on a rolling release basis with continuous delivery mechanisms, there are no discrete version numbers for affected or patched releases, making traditional patch management strategies ineffective and requiring users to track specific commit hashes rather than semantic versions.
From a technical perspective, this issue is classified under CWE-287, which denotes Improper Authentication. The root cause lies in the application's failure to validate whether the requesting entity possesses valid credentials before processing conversation requests when specific model arguments are supplied. By exploiting this logic flaw, an unauthorized actor can send crafted HTTP requests that trick the backend into treating unauthenticated traffic as legitimate session data. This type of vulnerability is often associated with ATT&CK technique T1078, Valid Accounts, although in this context it represents a bypass rather than credential theft, effectively allowing access without valid authentication tokens or sessions. The exploit has been publicly disclosed and documented, meaning that automated scanners and malicious actors can readily leverage this weakness to gain unauthorized access to the system's conversation capabilities.
The operational impact of this vulnerability is significant for any deployment running an affected version of the software. Since the backend handles user interactions with AI models, a successful exploitation could lead to data leakage, where sensitive conversational history or personal information provided by users is exposed to attackers. Furthermore, it may allow unauthorized usage of computational resources if the system charges per request, leading to financial loss through resource abuse. In more severe scenarios involving integrated systems, this bypass could serve as an initial foothold for further lateral movement within a network environment where such web UIs are deployed. The lack of official support from the maintainer exacerbates these risks, as there is no guaranteed timeline or commitment to provide security patches, leaving users exposed indefinitely unless they take independent remediation steps.
Mitigation strategies must focus on immediate isolation and code modification since standard update mechanisms will not resolve this issue due to the rolling release nature and lack of official support. Administrators should immediately restrict network access to the affected service using firewall rules or reverse proxy configurations that limit exposure to trusted IP addresses only, thereby reducing the attack surface for remote exploitation. For those with development capabilities, applying a manual patch by enforcing strict authentication checks within the _conversation function is necessary; this involves verifying session tokens or API keys before processing any model-specific requests regardless of the argument values provided. Additionally, implementing rate limiting and input validation can help mitigate potential abuse even if the core authentication flaw remains unpatched in legacy builds. Users are strongly advised to migrate away from unsupported versions of freegpt-webui to actively maintained alternatives that adhere to modern security standards and provide regular vulnerability updates.