fix: keep admin access to connections without access grants when admin bypass is disabled (#27581)

backend/open_webui/utils/access_control/__init__.py

@@ -163,10 +163,16 @@ async def has_connection_access(
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
         return True
 
+    access_grants = (connection.get('config') or {}).get('access_grants', [])
+    if not access_grants:
+        # No grants configured → private, admin-only: admins must keep access
+        # to connections only they can configure, even when they do not bypass
+        # access control globally.
+        return user.role == 'admin'
+
     if user_group_ids is None:
         user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id)}
 
-    access_grants = (connection.get('config') or {}).get('access_grants', [])
     return await has_access(user.id, 'read', access_grants, user_group_ids)
 
 

src/lib/components/admin/Settings/Integrations.svelte

@@ -297,7 +297,7 @@
 
 					<div class="mt-1 text-[0.6875rem] text-gray-400 dark:text-gray-600">
 						{$i18n.t(
-							'Connect to Open Terminal instances. All users will have access to file browsing and terminal tools through these servers.'
+							'Connect to Open Terminal instances. Admins and users granted access can use file browsing and terminal tools through these servers.'
 						)}
 					</div>
 					<a

src/lib/i18n/locales/en-US/translation.json

@@ -581,7 +581,7 @@
 	"Connect to a stable-diffusion-webui server running with the `--api` flag.": "",
 	"Connect to an AI provider to start chatting": "",
 	"Connect to Open Terminal instances to browse files and use them as always-on tools. Only one can be active at a time.": "",
-	"Connect to Open Terminal instances. All users will have access to file browsing and terminal tools through these servers.": "",
+	"Connect to Open Terminal instances. Admins and users granted access can use file browsing and terminal tools through these servers.": "",
 	"Connect to the ComfyUI server used for generation.": "",
 	"Connect to the ComfyUI server used for image edits.": "",
 	"Connect to your own OpenAI compatible API endpoints.": "",