CVE-2026-44563 in Open WebUI
Summary
by MITRE • 05/16/2026
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /api/generate, /api/embed, /api/embeddings, and /api/show endpoints accept any model name from the user and forward the request to the Ollama backend without checking whether the user is authorized to access that model. These endpoints only require get_verified_user (any authenticated non-pending user) and validate that the model exists in the full unfiltered model list, but never check AccessGrants.has_access(). This vulnerability is fixed in 0.9.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/16/2026
This vulnerability exists within Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline, where unauthorized access to model resources can occur through specific API endpoints. The flaw affects four critical endpoints: /api/generate, /api/embed, /api/embeddings, and /api/show which collectively enable users to interact with various AI models. The vulnerability stems from inadequate authorization checks that allow any authenticated user to request access to any model available in the system, regardless of their actual permissions or access rights.
The technical implementation of this vulnerability involves a critical flaw in the access control mechanism where the system only validates that a requested model exists within the complete model list without verifying whether the authenticated user possesses proper authorization to access that specific model. This represents a classic authorization bypass vulnerability that can be categorized under CWE-285, which deals with insufficient authorization checks. The system's reliance on get_verified_user function for authentication is insufficient since it only confirms that a user is authenticated and not pending, but fails to enforce proper access control policies through AccessGrants.has_access() validation.
The operational impact of this vulnerability is significant as it allows any authenticated user to potentially access restricted models that they should not be authorized to use. This creates a serious security risk where users can access proprietary or sensitive AI models, potentially leading to unauthorized data processing, model extraction, or other malicious activities. The vulnerability essentially undermines the platform's access control policies and can result in privilege escalation, unauthorized model usage, and potential data exposure. Attackers could exploit this to gain access to restricted models that might contain sensitive information or be configured with different security parameters.
The vulnerability is addressed in version 0.9.0 through proper implementation of access control checks that validate whether users have appropriate authorization before allowing access to specific models. This fix ensures that the AccessGrants.has_access() function is properly invoked during requests to the affected endpoints, preventing unauthorized model access while maintaining legitimate functionality for authorized users. The remediation aligns with ATT&CK technique T1078.004 which deals with Valid Accounts and the principle of least privilege enforcement. Organizations using Open WebUI should immediately upgrade to version 0.9.0 or later to mitigate this risk, as the vulnerability could enable attackers to bypass intended access controls and gain unauthorized access to model resources that should be restricted to specific user groups or roles.