Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-44567

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an authorized user role of user. By default, when Open WebUI is configured with new sign-ups enabled, the default user role is set to pending. In this configuration, an administrator is required to go into the Admin management panel following a new user registration and reconfigure the user to have a role of either user or admin
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:10dc1ddc979d290d5d8224278c65d83ed5292b77786d24f7b1f4af55efd271b6
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:1862fb4e2ad708166580edbe03e8ebd54d58062c38d0bf456de7a425c40aaa17 · sha256:46f33cbe0a260deb… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-602","description":"CWE-602: Client-Side Enforcement of Server-Side Security","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:1862fb4e2ad708166580edbe03e8ebd54d58062c38d0bf456de7a425c40aaa17 · sha256:46f33cbe0a260deb… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion
{"product":"open-webui","vendor":"open-webui","versions":[{"status":"affected","version":"< 0.1.124"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:1862fb4e2ad708166580edbe03e8ebd54d58062c38d0bf456de7a425c40aaa17 · sha256:46f33cbe0a260deb… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:1862fb4e2ad708166580edbe03e8ebd54d58062c38d0bf456de7a425c40aaa17 · sha256:46f33cbe0a260deb… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:1862fb4e2ad708166580edbe03e8ebd54d58062c38d0bf456de7a425c40aaa17 · sha256:46f33cbe0a260deb… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-602","description":"CWE-602: Client-Side Enforcement of Server-Side Security","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:1862fb4e2ad708166580edbe03e8ebd54d58062c38d0bf456de7a425c40aaa17 · sha256:46f33cbe0a260deb… · /containers/cna/problemTypes/1/descriptions/0

Source references

2 source assertions
{"tags":["exploit"],"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:1862fb4e2ad708166580edbe03e8ebd54d58062c38d0bf456de7a425c40aaa17 · sha256:46f33cbe0a260deb… · /containers/adp/0/references/0
{"name":"https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:1862fb4e2ad708166580edbe03e8ebd54d58062c38d0bf456de7a425c40aaa17 · sha256:46f33cbe0a260deb… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer