CVE-2026-45387

🔶 medium

Summary

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, when setting model permissions so that a group has read access to it, intending for other users to use it, those users also can read the model's system prompt. However users may consider their system prompt confidential, so this is considered a security issue. This vulnerability is fixed in 0.9.5.

CVSS Score

4.3

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-15

First Seen: 2026-05-17

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 5.3% of all 355,055 vulnerabilities in our database.

#336,143

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 15, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-05-19

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE IDs (Weakness Types)

CWE-200

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
openwebui	open_webui	Affected	< 0.9.5

🔗 References 1

https://github.com/open-webui/open-webui/security/ad...

Exploit Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-56398	⚠️ high	7.3	0.3	Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the ...	2026-07-15
CVE-2026-56400	⚠️ high	8.3	0.3	open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow...	2026-07-15
CVE-2026-59212	🔶 medium	5.4	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_...	2026-07-09
CVE-2026-59213	ℹ️ low	3.5	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all...	2026-07-09
CVE-2026-59214	⚠️ high	7.3	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs c...	2026-07-09
CVE-2026-59215	ℹ️ low	3.1	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa...	2026-07-09

These CVEs affect the same products