PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44562 open-webui CVE debrief

Open WebUI versions prior to 0.9.0 contain an insecure direct object reference vulnerability in the model import functionality. The POST /api/v1/models/import endpoint allows authenticated users with workspace.models_import permission to overwrite any existing model in the database by specifying a matching model ID in their import payload. The endpoint merges attacker-controlled data over existing model records without validating ownership or access grants, and bypasses the filter_allowed_access_grants check that protects other model mutation endpoints. This enables unauthorized modification of models regardless of their original ownership or configured access restrictions.

Vendor
open-webui
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations running self-hosted Open WebUI instances with multiple users or untrusted workspace.models_import permission holders; multi-tenant deployments where model isolation between users or teams is security-critical

Technical summary

The vulnerability exists in the POST /api/v1/models/import endpoint where imported model data is merged directly into existing database records when IDs match. The endpoint fails to verify that the requesting user owns or has legitimate access to modify the target model, and does not invoke the filter_allowed_access_grants function used by other model modification endpoints. This allows any user with the workspace.models_import permission to overwrite arbitrary models, potentially injecting malicious system prompts, altering model configurations, or disrupting service for other users. The attack requires network access and valid authentication with the specific permission, but no user interaction.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Open WebUI to version 0.9.0 or later
  • Review model access logs for unauthorized modifications between deployment and patch application
  • Audit workspace.models_import permission assignments to limit to trusted administrative users
  • Implement additional access control monitoring on model mutation endpoints pending upgrade

Evidence notes

CVE published 2026-05-15; NVD analysis completed with CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. Vendor advisory confirms exploit availability and fix in version 0.9.0. CWE-283 (Unverified Ownership) and CWE-862 (Missing Authorization) identified as primary weaknesses.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44562 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44562

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44562 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44562

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.