CVE-2026-85702: Missing Authentication in ramon-victor freegpt-webui

The vulnerability CVE-2026-85702 in ramon-victor freegpt-webui involves missing authentication in the _conversation function within the Backend Conversation API component (server/backend.py). This flaw allows remote attackers to manipulate the model argument, bypassing authentication controls. The product is delivered via a rolling release process, and no specific affected or fixed versions are provided. The vulnerability affects only unsupported versions of the software. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. There is no indication of known exploits in the wild or vendor-provided patches.

The vulnerability allows remote attackers to bypass authentication in the Backend Conversation API by manipulating the model argument, potentially leading to unauthorized access or actions within the freegpt-webui application. The impact is rated medium severity based on CVSS 4.0 scoring, indicating limited but notable confidentiality, integrity, and availability impacts. Since the product is no longer supported, affected versions remain vulnerable unless mitigated by other means.

No official patch or remediation is currently available for this vulnerability. Since the affected product versions are no longer supported by the maintainer, users should consider discontinuing use or isolating the affected system to prevent remote exploitation. Monitor vendor channels for any future updates or community-provided fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.