PT-2026-41187 · Unknown · Open-Webui

Published 2026-05-10 · Updated 2026-05-19 · CVE-2026-45385

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.5

Description An Insecure Direct Object Reference (IDOR) exists in the Channels feature, which allows any member of a channel to modify messages sent by other members, including administrators. In the update message by id() function, for channels of type group or dm, the system only verifies the caller's membership via the is user channel member() function and fails to verify if the user actually owns the message they are attempting to modify.

Recommendations Update to version 0.9.5. As a temporary workaround, consider disabling the Channels feature through the admin interface.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2026-07456

CVE-2026-45385

GHSA-WWHQ-CX22-F7VV

Affected Products

Open-Webui

References · 10

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-wwhq-cx22-f7vv · Exploit
• https://bdu.fstec.ru/vul/2026-07456 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45385 · Security Note
• https://osv.dev/vulnerability/GHSA-wwhq-cx22-f7vv · Vendor Advisory
• https://github.com/open-webui/open-webui/releases/tag/v0.9.5 · Note
• https://github.com/open-webui/open-webui · Note
• https://t.me/CVEtracker/53956 · Telegram Post
• https://twitter.com/CVEnew/status/2055457525059743919 · Twitter Post
• https://twitter.com/infoflowcloud/status/2055458393825882314 · Twitter Post
• https://t.me/cveNotify/163953 · Telegram Post