Open WebUI: Open WebUI has Improper Authorization Control
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Record
- CVE-2026-44567
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an authorized user role of user. By default, when Open WebUI is configured with new sign-ups enabled, the default user role is set to pending. In this configuration, an administrator is required to go into the Admin management panel following a new user registration and reconfigure the user to have a role of either user or admin before that user is able to access the web application. This vulnerability is fixed in 0.1.124.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat program for talking with AI language models that your organization runs on its own computers, and it can work entirely offline. This flaw affects versions before 0.1.124. It matters when new sign-ups are turned on. In that setup, each new account starts as "pending" and is meant to have no access until an administrator approves it in the admin panel. Because of this flaw, the part of the product that other software connects to does not properly check that an account has been approved, so a newly registered person could use it without that approval. This flaw is rated High.
What to do
- Find out who installed or runs Open WebUI for your organization: a staff member, a volunteer, or an outside IT provider.
- If that person works in your organization, ask them to update Open WebUI to version
0.1.124or later, which fixes this flaw. Every version before0.1.124is affected. - If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update will be done.
- If you are not sure whether your organization uses Open WebUI, ask whoever looks after your computers to check.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.