Open WebUI: Open WebUI has Broken Access Control for Completions API
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Record
- CVE-2026-45349
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API key (generated in OWUI) and the Chat ID of another user to continue the conversation of the other user. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI (also called OWUI) is a chat program that an organization runs on its own computers to talk with AI models, and it can work fully offline. This flaw affects all versions before 0.9.0. It is in the part of the product that apps and scripts use to send chat messages with a personal access key. Anyone with an account and their own key made in Open WebUI could use the chat ID of another user's conversation to continue that person's conversation. This flaw is rated High.
What to do
- Find out who installed and runs Open WebUI for your organization. If it is you or a staff member, that person should act. If an IT provider or vendor manages it, they should act.
- Update Open WebUI to version
0.9.0or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update will be done.
- After the update, check that the version shown is
0.9.0or later.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.