CVE-2026-45301

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N                                    

Vulnerability Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

Vulnerability Details

Published Date

May 14, 2026

Last Modified

May 18, 2026

CWE ID

CWE-284

Source

GitHub

Vendor

pip

Product

open-webui

External References

https://github.com/open-webui/open-webui/security/advisories/GHSA-r8wh-8m7r-fh33
https://github.com/advisories/GHSA-r8wh-8m7r-fh33

CVE-2026-45301

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment