PT-2026-39276 · Unknown · Open-Webui

CVE-2026-44559 · Published 2026-04-21 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0

Description An issue exists in the 'GET /api/v1/channels/{id}/members' endpoint where membership checks are only performed for group and dm channel types. For standard channels, including private ones, the system fails to perform a channel has access check before returning the member list. This allows any authenticated user who possesses a private channel's id (UUID) to enumerate all users with access to that channel, potentially leaking user identities, names, emails, roles, and profile images.

Recommendations Update to version 0.9.0.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-09664

CVE-2026-44559

GHSA-C7WP-3QH5-55PV

PYSEC-2026-2720

Affected Products

Open-Webui

References · 13

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-c7wp-3qh5-55pv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44559.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44559 · Security Note
• https://osv.dev/vulnerability/GHSA-c7wp-3qh5-55pv · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09664 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2720 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44559 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://t.me/CVEtracker/53943 · Telegram Post
• https://github.com/advisories/GHSA-c7wp-3qh5-55pv · Note
• https://twitter.com/infoflowcloud/status/2055458512193352066 · Twitter Post
• https://pypi.org/project/open-webui · Note
• https://twitter.com/CVEnew/status/2055457537789407740 · Twitter Post