PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44562 open-webui CVE debrief

Open WebUI versions prior to 0.9.0 contain an insecure direct object reference vulnerability in the model import functionality. The POST /api/v1/models/import endpoint allows authenticated users with workspace.models_import permission to overwrite any existing model in the database by specifying a matching model ID in their import payload. The endpoint merges attacker-controlled data over existing model records without validating ownership or access grants, and bypasses the filter_allowed_access_grants check that protects other model mutation endpoints. This enables unauthorized modification of models regardless of their original ownership or configured access restrictions.

Vendor
open-webui
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations running self-hosted Open WebUI instances with multiple users or untrusted workspace.models_import permission holders; multi-tenant deployments where model isolation between users or teams is security-critical

Technical summary

The vulnerability exists in the POST /api/v1/models/import endpoint where imported model data is merged directly into existing database records when IDs match. The endpoint fails to verify that the requesting user owns or has legitimate access to modify the target model, and does not invoke the filter_allowed_access_grants function used by other model modification endpoints. This allows any user with the workspace.models_import permission to overwrite arbitrary models, potentially injecting malicious system prompts, altering model configurations, or disrupting service for other users. The attack requires network access and valid authentication with the specific permission, but no user interaction.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Open WebUI to version 0.9.0 or later
  • Review model access logs for unauthorized modifications between deployment and patch application
  • Audit workspace.models_import permission assignments to limit to trusted administrative users
  • Implement additional access control monitoring on model mutation endpoints pending upgrade

Evidence notes

CVE published 2026-05-15; NVD analysis completed with CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. Vendor advisory confirms exploit availability and fix in version 0.9.0. CWE-283 (Unverified Ownership) and CWE-862 (Missing Authorization) identified as primary weaknesses.

Official resources

2026-05-15