Missing Authorization in Open WebUI - CVE-2026-44569
Published: May 6, 2026
Vulnerability identifier: #VU130243
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44569
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify or delete other users' messages.
The vulnerability exists due to missing authorization in the message update and delete endpoints when handling direct API requests for channel messages. A remote user can send crafted update or delete requests with a user-controlled message_id to modify or delete other users' messages.
Only instances with channels enabled are vulnerable. The issue affects users who have read access to a channel but do not own the target message.
Affected software
Open WebUI
How to mitigate CVE-2026-44569
Install security update from vendor's website.
Open WebUI - update to 0.6.19