PT-2026-41174 · Unknown · Open-Webui

Published 2026-04-21 · Updated 2026-05-15 · CVE-2026-45339

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0

Description An issue exists where administrators' restrictions on API endpoint access can be bypassed. While requests using the Authorization: Bearer header are correctly blocked when restricted from the '/api/v1/messages' endpoint, providing the same API key via the x-api-key header allows the request to be authenticated and processed. This occurs because the endpoint restriction check is only applied to keys presented via the Authorization header, whereas the x-api-key header, used for Anthropic-compatible API paths, skips this check while remaining valid for authentication. Consequently, any API key can access any endpoint regardless of its configured restrictions.

Recommendations Update to version 0.9.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-07196

CVE-2026-45339

GHSA-57Q6-FVP4-PQMM

Affected Products

Open-Webui

References · 7

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-57q6-fvp4-pqmm · Exploit
• https://bdu.fstec.ru/vul/2026-07196 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45339 · Security Note
• https://osv.dev/vulnerability/GHSA-57q6-fvp4-pqmm · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/releases/tag/v0.9.0 · Note
• https://t.me/CVEtracker/53951 · Telegram Post