open-webui Open WebUI up to 0.9.4 Tool Update Endpoint update privileges management

Summaryinfo

A vulnerability has been found in open-webui Open WebUI up to 0.9.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/tools/id/{id}/update of the component Tool Update Endpoint. The manipulation leads to privileges management. This vulnerability is traded as CVE-2026-45395. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in open-webui Open WebUI up to 0.9.4 and classified as critical. This issue affects an unknown part of the file /api/v1/tools/id/{id}/update of the component Tool Update Endpoint. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint. This allows a user who has been explicitly denied tool management capabilities ( and who the administrator considers untrusted for code execution ) to replace a tool's server-side Python content and trigger execution, bypassing the intended workspace.tools security boundary. This vulnerability is fixed in 0.9.5.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-45395 since 05/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 0.9.5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• open-webui

Name

• Open WebUI

Version

• 0.9.0
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion