PT-2026-39272 · Unknown · Open-Webui

Published 2026-05-08 · Updated 2026-05-19 · CVE-2026-44555

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0

Description Open WebUI supports model composition through the base model id variable, allowing a user-defined model to reference a base model for inference. An access control flaw exists where the system verifies access to the composed model but fails to re-verify access to the underlying chained base model. Furthermore, the model creation and import endpoints accept arbitrary base model id values without validating if the caller has permission to access that base model. This allows users with model creation permissions to create a model that chains to a restricted base model and invoke it, causing the server to process the request using the admin-configured API key. This bypasses access grant policies and can lead to unauthorized use of premium or internal models.

Recommendations Update to version 0.9.0. As a temporary workaround, restrict the model creation and import permissions to trusted users only to prevent the creation of unauthorized model chains.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-44555

GHSA-9VVH-QMJX-P4Q8

Affected Products

Open-Webui

References · 6

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-9vvh-qmjx-p4q8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44555 · Security Note
• https://osv.dev/vulnerability/GHSA-9vvh-qmjx-p4q8 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/2055457533209309344 · Twitter Post
• https://t.me/cveNotify/163970 · Telegram Post