Improper access control in Open WebUI - CVE-2026-44550
Published: May 5, 2026
Vulnerability identifier: #VU130165
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44550
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create folders in other users' accounts.
The vulnerability exists due to improper access control in the folder creation endpoint and FolderForm model when handling crafted folder creation requests. A remote user can supply a crafted user_id value in the POST body to create folders in other users' accounts.
Exploitation requires an authenticated account with folders permission and knowledge or guessing of the victim's user UUID.
Affected software
Open WebUI
How to mitigate CVE-2026-44550
Install security update from vendor's website.
Open WebUI - update to 0.9.0