Vulnerability · Published May 15, 2026 · Assigned by GitHub_M

CVE-2026-44550Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Medium 5.0

In plain English

A medium-severity missing authorization in open-webui from open-webui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.3%top 78.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, FolderForm uses model_config = ConfigDict(extra='allow'), which permits arbitrary fields to pass through Pydantic validation and be included in model_dump(exclude_unset=True). In insert_new_folder, the server-assigned user_id is placed at the start of the dict and then overwritten by the spread of form data. Because FolderModel declares user_id: str as a real field (not just a form extra), any attacker-supplied user_id in the POST body is accepted by the model and persisted on the Folder row. This vulnerability is fixed in 0.9.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	open-webui	0.9.0	GHSA-hr43-rjmr-7wmm
PyPI	open-webui	0.9.0	PYSEC-2026-2735

Affected products (as reported)

Vendor	Product	Versions
open-webui	open-webui	< 0.9.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

References

https://github.com/open-webui/open-webui/security/advisories/GHSA-hr43-rjmr-7wmm x_refsource_CONFIRM