What happened
Open WebUI before 0.11.4 fails to re-check that a requested model-provider backend is enabled when the caller passes an explicit backend index on listing routes. A user of the UI can reach disabled providers, trigger requests that carry the configured API keys, read backend version strings, and enumerate connections that administrators intended to restrict.
Why it matters
Disabled backends in Open WebUI usually hold dedicated API keys/endpoints operators want hidden from general users. This authorization gap lets any authenticated user poke previously-gated model providers, potentially burning quota or exposing connection metadata — a configuration-boundary bypass in a widely deployed self-hosted chat UI.
Attack vector
An authenticated user supplies an explicit backend index as a path segment or query parameter on Ollama/OpenAI-compatible listing routes, reaching disabled model provider backends; the requests carry the configured API keys, and version strings and connection metadata are readable.
Affected systems
open-webui < 0.11.4 (Ollama and OpenAI-compatible model listing routes)
Mitigation
Upgrade to Open WebUI 0.11.4 (GHSA-hm62-64q2-6gxw).