CVE-2026-85702

Received Received - Intake

Missing Authentication in FreeGPT WebUI Backend

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-85702

Affected Vendors & Products

Vendor	Product	Version / Range
ramon-victor	freegpt-webui	to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is in the ramon-victor freegpt-webui software, specifically in the Backend Conversation API. It allows remote attackers to bypass authentication by manipulating the model argument in the _conversation function of server/backend.py. The flaw exists in versions up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.

Detection Guidance

This vulnerability involves missing authentication in the Backend Conversation API due to improper handling of the model argument in server/backend.py. Detection requires checking for unauthenticated API access to conversation endpoints. Inspect server logs for requests to /conversation or similar paths without valid authentication tokens. Look for unusual model parameter values in API requests. Ensure the freegpt-webui service is not exposed to untrusted networks.

Impact Analysis

An attacker could remotely access the Backend Conversation API without authentication, potentially leading to unauthorized data access, manipulation, or service disruption. Since the product is no longer supported, no patches are available.

Compliance Impact

This vulnerability allows remote attackers to bypass authentication due to missing checks in the Backend Conversation API. Such flaws could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy).

Mitigation Strategies

Since the product is no longer supported and operates on a rolling release basis, the best immediate step is to discontinue use of ramon-victor freegpt-webui. If continued use is necessary, implement network-level controls to restrict access to the Backend Conversation API endpoint. Ensure no sensitive data is processed by this application.

Hi! I’m here to help you understand CVE-2026-85702. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70