A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. (CVE-2026-85702)

CVE-2026-85702 is a vulnerability in the ramon-victor freegpt-webui project, specifically in the _conversation function of the Backend Conversation API located in server/backend.py. The flaw allows remote attackers to bypass authentication by manipulating the 'model' argument. The product is delivered via a rolling release process, so no discrete affected or fixed versions are provided. The vulnerability affects unsupported versions only. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a low to medium level.

The vulnerability allows remote attackers to bypass authentication controls, potentially leading to unauthorized access to backend conversation functionality. This can result in partial compromise of confidentiality, integrity, and availability of the affected system. Since the product is no longer supported by the maintainer, no official fixes or updates are available, increasing risk for users still running affected versions.

No official patch or fix is currently available for this vulnerability as the product is no longer supported by the maintainer. Users should consider discontinuing use of the affected software or migrating to a supported alternative. Monitor vendor or community channels for any unofficial patches or mitigations. Given the lack of support, no direct remediation is provided.