PT-2026-41194 · Unknown · Open-Webui

Published

2026-04-06

·

Updated

2026-05-15

·

CVE-2026-45399

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:S/C:P/I:N/A:C
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0
Description An authorization issue allows any authenticated user with low privileges to enumerate active background tasks across the system and stop tasks belonging to other users. This occurs because the system fails to verify if the task belongs to the user making the request, operating instead on a global task namespace. An attacker can disrupt system-wide chat usage by continuously canceling other users' active tasks, affecting the integrity and usability of multi-user deployments.
Technical details include the following endpoints:
  • 'GET /api/tasks'
  • 'POST /api/tasks/stop/{task id}'
The task id variable is accepted without ownership validation.
Recommendations Update to version 0.9.0 or later. As a temporary workaround, restrict access to the 'GET /api/tasks' and 'POST /api/tasks/stop/{task id}' endpoints to administrative users only.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07192
CVE-2026-45399
GHSA-8JJP-R2W2-4V22

Affected Products

Open-Webui