CVE-2026-70484: Open WebUI: Users denied the image-generation permission can still generate images via chat completions

The chat-completions endpoint stores the request's client-supplied features object in request metadata. process_chat_payload in the chat middleware then calls the image handler whenever features.image_generation is truthy. Permission checks existed on the direct /images/generations and /images/edit routes and on native function-calling tool registration, but not on this legacy chat path. The flag expresses intent, yet the handler treated it as an authorization decision.

The attacker is an authenticated user the administrator has denied image generation. On 0.10.0 and later they also set params.function_calling to legacy; on 0.9.x and earlier that mode was the default, so no extra parameter is needed. Native function calling is unaffected.

The result is consumption of the operator's configured image provider: API credits, quota and storage for generated files. If an image is in the conversation and image editing is enabled, the image-edit provider is reachable too. No provider credentials leak and no other user's data is exposed, which keeps this at medium.

Open WebUI >= 0.7.0, < 0.11.0, where an administrator has enabled image generation (ENABLE_IMAGE_GENERATION, off by default), configured a provider, and explicitly revoked the per-user image-generation permission for some users. The permission is granted by default, so deployments that never revoked it see no change. Check the version:

pip show open-webui

Upgrade to 0.11.0:

pip install --upgrade open-webui==0.11.0

Commit 897d69a (PR 26703) makes the legacy chat-features block re-check features.image_generation against the caller's permissions before it calls the image handler. Switching affected models to native function calling avoids the legacy path, since that path already checked the permission. The advisory lists no further workaround.

Check your image provider's usage logs against the users who hold the permission. Image files or generation requests tied to accounts that were denied features.image_generation indicate abuse. In request logs, look for chat-completion calls from those accounts with features containing image_generation and params.function_calling set to legacy.

Summary

An authenticated user whose features.image_generation permission has been revoked can still make the server generate images by sending the feature flag in a chat-completion request. The chat pipeline took the client-supplied features object at face value and never re-checked the permission that the direct image routes enforce, so the denial applied to the UI affordance but not to the server-side generation path.

Preconditions

Image generation must be enabled and a provider configured by the administrator (ENABLE_IMAGE_GENERATION is off by default). The per-user permission defaults to granted, so only deployments where an administrator explicitly revoked it for some users are affected. On 0.10.0 and later the caller must also set params.function_calling to legacy; on 0.9.x and earlier the legacy mode was the default, so no special parameter was needed. Deployments on native function calling are unaffected, since that path checks the permission before registering the image tools.

Impact

A user the administrator has explicitly denied image generation can consume the operator's configured provider through the chat API, spending the operator's API credits and provider quota and writing generated files to the operator's storage. Where an image is present in the conversation and image editing is enabled, the same handler reaches the image-edit provider as well. No provider credentials are exposed, and no other user's data is reachable.

Fix

Fixed in 897d69a (#26703). The legacy chat-features block now re-checks features.image_generation against the caller's permissions before invoking the image handler, matching the check the direct image routes and the native function-calling path already performed.

Root cause

The chat-completions endpoint stored the request's features object into request metadata, and process_chat_payload in the chat middleware dispatched to the image handler purely on the truthiness of that client-supplied flag. Permission enforcement lived on the two surfaces that were reached from the UI, the direct /images/generations and /images/edit routes and the native function-calling tool registration, and was simply absent on the legacy chat path. The flag was treated as a statement of user intent, which it is, rather than as an authorization decision, which the handler behind it made it.

Credits

@DavidCarliez, for identifying that the chat pipeline honours the client-supplied image-generation feature flag without re-checking the permission.