Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-44554

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/retrieval/process/web endpoint accepts a user-supplied collection_name and an overwrite query parameter (default: True). It performs no authorization check on whether the calling user owns or has write access to the target collection. When overwrite=True, save_docs_to_vector_db calls VECTOR_DB_CLIENT.delete_collection() on the target collection before writing new co
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:4b3ced4c29cd718f133876e10296d33ff5987e239befc25605d386d670d50f3c
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"open-webui","vendor":"open-webui","versions":[{"status":"affected","version":"< 0.9.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:672652deff3260d3efbcee3b45854239f161361f94a572eff57cd5558e1ef3b5 · sha256:e8bbddfa7a5977f1… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:672652deff3260d3efbcee3b45854239f161361f94a572eff57cd5558e1ef3b5 · sha256:e8bbddfa7a5977f1… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:672652deff3260d3efbcee3b45854239f161361f94a572eff57cd5558e1ef3b5 · sha256:e8bbddfa7a5977f1… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"https://github.com/open-webui/open-webui/security/advisories/GHSA-7r82-qhg4-6wvj","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-7r82-qhg4-6wvj"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:672652deff3260d3efbcee3b45854239f161361f94a572eff57cd5558e1ef3b5 · sha256:e8bbddfa7a5977f1… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer