Vulnerability · Published May 15, 2026 · Assigned by GitHub_M

CVE-2026-44570Open WebUI: Inconsistent authorization controls within memories API

High 8.3

In plain English

A high-severity authorization bypass via user-controlled key in open-webui from open-webui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.3%top 77.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, authorization controls surrounding the memories API were inconsistent, resulting in the ability of a standard user to delete, restore, and view the contents of other users' memories. Using a newly created non-admin user with no existing memories, it is possible to view existing memories via POST /api/v1/memories/query. Similarly, even if a non-admin user cannot modify another user's memory data via POST /api/v1/memories/{memory_id}/update, the endpoint's response improperly leaks the content of that memory if a valid memory_id is known. The DELETE /api/v1/memories/{memory_id} can also be used by any user to delete an existing memory. Deleted memories can then be restored by calling the POST /api/v1/memories/{memory_id}/update endpoint again. This vulnerability is fixed in 0.6.19.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	open-webui	0.6.19	GHSA-hmjq-crxp-7rjw
PyPI	open-webui	0.6.19	PYSEC-2026-2733

Affected products (as reported)

Vendor	Product	Versions
open-webui	open-webui	< 0.6.19

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/open-webui/open-webui/security/advisories/GHSA-hmjq-crxp-7rjw x_refsource_CONFIRM