Improper Authorization in Open WebUI - CVE-2026-44567

Vulnerability details

The vulnerability allows a remote attacker to access authenticated API functionality and disclose limited information, modify limited data, or affect availability.

The vulnerability exists due to improper authorization in authenticated API endpoints when handling requests with a valid JWT issued to a newly registered pending account. A remote attacker can sign up for an account and use the returned token to access endpoints intended for verified users to access authenticated API functionality and disclose limited information, modify limited data, or affect availability.

Only deployments with new sign-ups enabled are exposed to registration-based exploitation, and pending accounts are treated as authenticated users by the API despite client-side restrictions.

Affected software

How to mitigate CVE-2026-44567

External References

• https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf
• https://github.com/open-webui/open-webui/blob/0399a69b73de9789c4221acedea70d528e1346c4/backend/utils/utils.py#L77-L97

Related Security Bulletins

• Multiple vulnerabilities in Open WebUI