Improper Authorization in Open WebUI - CVE-2026-45345
Published: May 11, 2026
Vulnerability identifier: #VU130942
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45345
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify another user's private model.
The vulnerability exists due to improper authorization in the model update function when handling POST requests to the model update endpoint. A remote user can send a crafted update request for another user's model to modify another user's private model.
By changing access permissions during editing, unauthorized access can be gained.
Affected software
Open WebUI
How to mitigate CVE-2026-45345
Install security update from vendor's website.
Open WebUI - update to 0.5.7