PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45345 open-webui CVE debrief

Open WebUI versions prior to 0.5.7 contain an insecure direct object reference vulnerability where authenticated users can modify another user's private models by manipulating access permission parameters during the edit operation. The flaw stems from missing authorization checks when processing model updates, allowing attackers to escalate privileges and gain unauthorized access to models explicitly marked as Private. This represents a confidentiality and integrity risk in multi-user deployments where model isolation is expected. The vulnerability was disclosed via GitHub Security Advisory and patched in version 0.5.7 released May 2026. No known exploitation in the wild has been reported. Organizations should prioritize upgrading to 0.5.7 or later and review access logs for anomalous model modifications between deployment and patch application.

Vendor
open-webui
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-18
Advisory published
2026-05-15
Advisory updated
2026-05-18

Who should care

Organizations running multi-user Open WebUI deployments with sensitive or proprietary AI models; security teams managing self-hosted AI infrastructure; compliance officers responsible for data isolation in AI platforms; DevOps teams maintaining Open WebUI instances with external user access

Technical summary

The vulnerability exists in Open WebUI's model editing functionality where the application fails to validate that the requesting user has ownership or explicit authorization to modify the target model. When a user submits a model update request, the application accepts permission changes without verifying the requester's relationship to the model. This allows any authenticated user to alter the visibility settings of another user's private models, effectively converting private resources to accessible states. The attack requires low complexity network access and valid user credentials, with no user interaction required. The integrity impact is rated high per CVSS due to unauthorized modification capability, while confidentiality and availability impacts are not directly scored in the base metric. The fix in 0.5.7 implements proper authorization checks before processing model permission updates.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Open WebUI to version 0.5.7 or later to remediate the authorization bypass vulnerability
  • Review model access logs and audit trails for unauthorized modifications to private models prior to patching
  • Verify that model ownership and visibility controls enforce proper authorization checks after upgrade
  • Implement principle of least privilege for user accounts with model editing capabilities
  • Monitor for anomalous API requests to model update endpoints that include permission parameter changes

Evidence notes

NVD analyzed status; GitHub Security Advisory GHSA-gm54-m39w-grjp confirms vendor acknowledgment and fix in 0.5.7; CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N aligns with description of unauthorized modification capability; CWE-285 (Improper Authorization) classified as secondary weakness source

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45345 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45345

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45345 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45345

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.