PT-2026-56830 · Openwebui · Open-Webui

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-59226

Mitre

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute automation rehydrated automation owners without rechecking that they were still active or still had features.automations, and check model access only enforced private-model grants for the exact user role, allowing deactivated pending users to continue scheduled model execution. This issue is fixed in version 0.10.0.

Fix

Missing Authorization

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-285

CWE-863

Related Identifiers

CVE-2026-59226

Affected Products

Open-Webui

References · 5

• https://github.com/open-webui/open-webui/commit/920b655f4689e2118de928fbc936f6ebd4fed396 · Patch
• https://github.com/open-webui/open-webui/pull/26047 · Patch
• https://github.com/open-webui/open-webui/security/advisories/GHSA-mvx4-532p-xfm9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59226 · Security Note
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 · Note