Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI allows admins to restrict which API endpoints an API key can access. When an API key is restricted from /api/v1/messages, requests using the Authorization: Bearer sk-... header are correctly blocked with 403. However, the same key sent via the x-api-key header bypasses the restriction entirely — the request is authenticated, the model is invoked, and a full response is returned. This vulnerability is fixed in 0.9.0.
References
| Link | Resource |
|---|---|
| https://github.com/open-webui/open-webui/security/advisories/GHSA-57q6-fvp4-pqmm | Exploit Vendor Advisory |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-57q6-fvp4-pqmm | Exploit Vendor Advisory |
Configurations
History
19 May 2026, 03:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-webui/open-webui/security/advisories/GHSA-57q6-fvp4-pqmm - Exploit, Vendor Advisory | |
| First Time |
Openwebui
Openwebui open Webui |
|
| CPE | cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
18 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-webui/open-webui/security/advisories/GHSA-57q6-fvp4-pqmm - |
15 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-15 20:16
Updated : 2026-05-19 03:07
NVD link : CVE-2026-45339
Mitre link : CVE-2026-45339
CVE.ORG link : CVE-2026-45339
JSON object : View
Products Affected
openwebui
- open_webui
CWE
CWE-863
Incorrect Authorization