Vulnerability · Published May 15, 2026 · Assigned by GitHub_M

CVE-2026-44562Open WebUI: Model Import Overwrites Any Model Without Ownership Check

Medium 6.5

In plain English

A medium-severity missing authorization in open-webui from open-webui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/models/import endpoint allows users with the workspace.models_import permission to overwrite any existing model in the database, regardless of ownership. When an imported model's ID matches an existing model, the endpoint merges the attacker's payload over the existing model data and writes it to the database with no ownership or access grant validation. Additionally, filter_allowed_access_grants is never called, bypassing the access grant restrictions enforced on all other model mutation endpoints. This vulnerability is fixed in 0.9.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	open-webui	0.9.0	GHSA-mqq6-cqcx-38vg
PyPI	open-webui	0.9.0	PYSEC-2026-2749

Affected products (as reported)

Vendor	Product	Versions
open-webui	open-webui	< 0.9.0

Weakness: CWE-862, CWE-283 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/open-webui/open-webui/security/advisories/GHSA-mqq6-cqcx-38vg x_refsource_CONFIRM