Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-59226Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Low 3.1

In plain English

A low-severity missing authorization in open-webui from open-webui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.5%top 55.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automations, and check_model_access only enforced private-model grants for the exact user role, allowing deactivated pending users to continue scheduled model execution. This issue is fixed in version 0.10.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	open-webui	0.10.0	GHSA-mvx4-532p-xfm9
PyPI	open-webui	0.10.0	PYSEC-2026-3602

Affected products (as reported)

Vendor	Product	Versions
open-webui	open-webui	>= 0.9.0, < 0.10.0

Weakness: CWE-285, CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/open-webui/open-webui/security/advisories/GHSA-mvx4-532p-xfm9 x_refsource_CONFIRM
https://github.com/open-webui/open-webui/pull/26047 x_refsource_MISC
https://github.com/open-webui/open-webui/commit/920b655f4689e2118de928fbc936f6ebd4fed396 x_refsource_MISC
https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC