Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing…
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- Record
- CVE-2026-45399
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate active background tasks across the system and stop tasks belonging to other users via the GET /api/tasks and POST /api/tasks/stop/{task_id} methods. This allows a casual user to disrupt system-wide chat usage by continuously canceling other users' active tasks. This is a real authorization vulnerability affecting integrity and usability in multi-user deployments. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat program for AI language models that an organization can run on its own computers, and it can work entirely offline. This flaw affects versions before 0.9.0, and it matters most where several people share one installation. Any user who can log in, even one with the most basic account, can see the background jobs running for everyone on the system and stop jobs that belong to other users. By doing this over and over, one person could keep canceling other people's chats and disrupt chat use across the whole organization. This flaw is rated High.
What to do
- If you or someone on your staff installed and runs Open WebUI, have that person check which version is in use.
- If it is older than
0.9.0, update it to0.9.0or a later release, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to
0.9.0will be done. - After the update, check that the version shown is
0.9.0or later, so you know the fix is in place.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.