Open WebUI: Open WebUI's responses passthrough endpoint lacks access control authorization
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- Record
- CVE-2026-44556
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM providers without enforcing per-model access control. While the primary chat completion endpoint (generate_chat_completion) checks model ownership, group membership, and AccessGrants before allowing a request, the /responses proxy only validates that the user has a valid session via get_verified_user. This allows any authenticated user to interact with any model configured on the instance by sending a POST request to /api/openai/responses with an arbitrary model ID. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat app for working with AI language models that an organization runs on its own computers. This flaw affects versions before 0.9.0. A part of the product that passes requests straight on to the AI model services does not check which models each user is allowed to use. As a result, anyone with a working login on your installation could use any AI model set up on it, including models you have limited to certain people or groups. This flaw is rated High. If your organization does not use Open WebUI, this flaw does not affect you.
What to do
- Find out who runs Open WebUI for your organization: the person who installed it, or the IT provider or vendor who manages it.
- If someone in your organization runs it, ask them to update Open WebUI to version
0.9.0or later, which fixes this flaw. - If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- For more details about the fixed release, check the vendor advisory linked on this page.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.