| Title | ramon-victor (https://github.com/ramon-victor) freegpt-webui latest (main/master branch) CWE-284 (Improper Access Control / Broken Access Control - autho |
|---|
| Description | Missing Idempotency / Global State Mutation - Location: `server/backend.py:108`. The getJailbreak function permanently mutates the module-level global dictionary `special_instructions` (imported from server/config.py) by appending `two_responses_instruction` to the instruction content on every call with a non-default jailbreak mode. Since this dictionary is shared across ALL requests, users, and threads in the process, each request that selects e.g. 'gpt-dan-11.0' or 'gpt-evil' permanently grows the jailbreak prompt. After N requests, the instruction text is duplicated N times. The business rule violated is that request handling should be stateless/idempotent selecting the same jailbreak mode should produce the same instructions each time. Instead, the first user gets the correct instruction, the second user gets it doubled, the third tripled, and so on. Additionally, the `if jailbreak in special_instructions:` membership check is performed AFTER the dictionary access on the preceding line, so any jailbreak value not in the dictionary (and not 'default') raises an unhandled KeyError before the guard check can protect it. Exploitation: 1. An attacker sends repeated POST requests to /backend-api/v2/conversation with JSON body containing `"jailbreak": "gpt-dan-11.0"` and minimal valid meta/content fields. 2. Each request permanently appends the full `two_responses_instruction` text (~500 chars) to the global `special_instructions['gpt-dan-11.0'][0]['content']`. 3. After 50 requests, the jailbreak system prompt is ~25,000 characters of duplicated instruction, which: (a) causes degraded/confused model output for ALL subsequent users who select that jailbreak mode, (b) wastes upstream API tokens/cost proportionally, (c) can exceed model context windows causing failures, and (d) constitutes a low-bandwidth denial-of-service vector since a single small HTTP request corrupts shared state for all users. |
|---|
| Source | ⚠️ https://gist.github.com/Galaxync/04d5b16498911c405580c735148a53be |
|---|
| User | Galaxyn (UID 98388) |
|---|
| Submission | 07/19/2026 03:57 (2 months ago) |
|---|
| Moderation | 09/04/2026 16:43 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 398807 [ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc Jailbreak Mode server/backend.py getJailbreak allocation of resources] |
|---|
| Points | 20 |
|---|