Vulnerability details
CVE-2026-44567
open-webui open-webui
Open WebUI: Open WebUI Improper Authorization Control
CVSS 3.1
7.3High
Official description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an authorized user role of user. By default, when Open WebUI is configured with new sign-ups enabled, the default user role is set to pending. In this configuration, an administrator is required to go into the Admin management panel following a new user registration and reconfigure the user to have a role of either user or admin before that user is able to access the web application. This vulnerability is fixed in 0.1.124.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.3High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| open-webui | open-webui | < 0.1.124 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-16
- Last updated
- 2026-05-18
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.23%
Probability of exploitation in 30 days
13.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-863Incorrect Authorization
- CWE-602Client-Side Enforcement of Server-Side Security