CVE-2026-45349

⚠️ high

Summary

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API key (generated in OWUI) and the Chat ID of another user to continue the conversation of the other user. This vulnerability is fixed in 0.9.0.

CVSS Score

7.1

High

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-15

First Seen: 2026-05-17

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 52.3% of all 349,494 vulnerabilities in our database.

#166,658

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 19, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-05-19

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE IDs (Weakness Types)

CWE-639

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
openwebui	open_webui	Affected	< 0.9.0

🔗 References 1

https://github.com/open-webui/open-webui/security/ad...

Exploit Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-56398	⚠️ high	7.3	0.3	Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the ...	2026-07-15
CVE-2026-56400	⚠️ high	8.3	0.3	open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow...	2026-07-15
CVE-2026-59212	🔶 medium	5.4	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_...	2026-07-09
CVE-2026-59213	ℹ️ low	3.5	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all...	2026-07-09
CVE-2026-59214	⚠️ high	7.3	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs c...	2026-07-09
CVE-2026-59215	ℹ️ low	3.1	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa...	2026-07-09

These CVEs affect the same products