PT-2026-39673 · Unknown · Open-Webui

Published 2026-05-11 · Updated 2026-05-16 · CVE-2026-44571

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.6

Description In standard channels (where channel.type is neither group nor dm), the endpoint "POST /api/v1/channels/{channel id}/messages/{message id}/update" can be accessed with read permission only. When access control is set to None, the authorization check has access(..., type="read") evaluates to True, allowing authenticated users who are not the message owner to update messages. This leads to the unauthorized modification of other users' messages.

Recommendations Update to version 0.8.6.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-44571

GHSA-JGJ3-R8HR-9PJW

Affected Products

Open-Webui

References · 8

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjw · Exploit
• https://osv.dev/vulnerability/GHSA-jgj3-r8hr-9pjw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44571 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://t.me/cveNotify/163702 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2055490322491129978 · Twitter Post
• https://twitter.com/CVEnew/status/2055457495515078860 · Twitter Post
• https://t.me/CVEtracker/53972 · Telegram Post