CVE-2026-44560

🔶 medium

Summary

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the type: "file" (non-full-context), type: "text" with collection_name, and bare collection_name/collection_names paths in the get_sources_from_items function perform vector store queries without any authorization check, allowing users to extract content from files and knowledge bases they do not have access to. This vulnerability is fixed in 0.9.0.

CVSS Score

6.5

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-15

First Seen: 2026-05-17

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 47.6% of all 338,292 vulnerabilities in our database.

#177,181

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 15, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-05-19

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-862

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
openwebui	open_webui	Affected	< 0.9.0

🔗 References 1

https://github.com/open-webui/open-webui/security/ad...

Exploit Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-56398	⚠️ high	7.3	0.3	Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the ...	2026-07-15
CVE-2026-56400	⚠️ high	8.3	0.3	open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow...	2026-07-15
CVE-2026-59212	🔶 medium	5.4	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_...	2026-07-09
CVE-2026-59213	ℹ️ low	3.5	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all...	2026-07-09
CVE-2026-59214	⚠️ high	7.3	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs c...	2026-07-09
CVE-2026-59215	ℹ️ low	3.1	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa...	2026-07-09

These CVEs affect the same products