Open WebUI: Open WebUI has inconsistent authorization controls within memories API
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Record
- CVE-2026-44570
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- August 3, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, authorization controls surrounding the memories API were inconsistent, resulting in the ability of a standard user to delete, restore, and view the contents of other users' memories. Using a newly created non-admin user with no existing memories, it is possible to view existing memories via POST /api/v1/memories/query. Similarly, even if a non-admin user cannot modify another user's memory data via POST /api/v1/memories/{memory_id}/update, the endpoint's response improperly leaks the content of that memory if a valid memory_id is known. The DELETE /api/v1/memories/{memory_id} can also be used by any user to delete an existing memory. Deleted memories can then be restored by calling the POST /api/v1/memories/{memory_id}/update endpoint again. This vulnerability is fixed in 0.6.19.
Description quoted from the NVD record.
Who is affected
Open WebUI is a self-hosted platform for chatting with artificial intelligence models, designed to run entirely offline. This flaw affects versions before 0.6.19 and sits in the feature that stores each user's saved memories. Because the permission checks in that feature are inconsistent, any ordinary user with an account, not just an administrator, could view the contents of other users' memories, delete them, and restore memories that were deleted. A brand new account with no memories of its own is enough to do this. This flaw is rated High.
What to do
- If you or someone in your organization installed and runs Open WebUI, that person should act: check which version is in use.
- Update Open WebUI to version
0.6.19or later, which fixes this flaw. Any version before0.6.19is affected. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to
0.6.19or later will be done. - After updating, check that the version shown is
0.6.19or later.
Analysis written from the source record as of August 3, 2026 and reviewed before publishing.