Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the GET /api/v1/channels/{id}/members endpoint only checks membership for group and dm channel types (lines 467-469). For standard channels — including private ones — there is no channel_has_access check before returning the member list. Any authenticated user who knows a private channel's UUID can enumerate all users with access to that channel. This vulnerability is fixed in 0.9.0.
References
| Link | Resource |
|---|---|
| https://github.com/open-webui/open-webui/security/advisories/GHSA-c7wp-3qh5-55pv | Exploit Vendor Advisory |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-c7wp-3qh5-55pv | Exploit Vendor Advisory |
Configurations
History
19 May 2026, 03:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-webui/open-webui/security/advisories/GHSA-c7wp-3qh5-55pv - Exploit, Vendor Advisory | |
| First Time |
Openwebui
Openwebui open Webui |
|
| CPE | cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
15 May 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-webui/open-webui/security/advisories/GHSA-c7wp-3qh5-55pv - |
15 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-15 20:16
Updated : 2026-05-19 03:09
NVD link : CVE-2026-44559
Mitre link : CVE-2026-44559
CVE.ORG link : CVE-2026-44559
JSON object : View
Products Affected
openwebui
- open_webui
CWE
CWE-862
Missing Authorization