PT-2026-41189 · Unknown · Open-Webui

Published 2026-05-10 · Updated 2026-05-19 · CVE-2026-45387

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.5

Description An issue exists in the self-hosted artificial intelligence platform where users can access the system prompt of a model they do not own if a group has been granted read access. This allows for system prompt leakage, which may contain confidential information. The issue occurs because the workspace model edit page "/workspace/models/edit?id=notmymodel" can be opened for models not in the user's workspace. At the API level, the endpoint "/api/v1/models/model?id=notmymodel" returns model details, specifically the params.system variable, even when the model is not listed in the REST API list due to lack of write permissions.

Recommendations Update to version 0.9.5.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-07133

CVE-2026-45387

GHSA-H2CW-7QW9-56XR

Affected Products

Open-Webui

References · 11

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-h2cw-7qw9-56xr · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45387 · Security Note
• https://osv.dev/vulnerability/GHSA-h2cw-7qw9-56xr · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07133 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/releases/tag/v0.9.5 · Note
• https://t.me/CVEtracker/53957 · Telegram Post
• https://twitter.com/infoflowcloud/status/2055458378919371230 · Twitter Post
• https://twitter.com/CVEnew/status/2055457523931464091 · Twitter Post
• https://t.me/cveNotify/163963 · Telegram Post
• https://t.me/cveNotify/163694 · Telegram Post