QSearchQSearch

CVE-2026-45667

6.5 MEDIUM

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline

Published: 2026-05-15 · Last updated: 2026-05-19

Severity and scoring

CVSS
6.5 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE
CWE-862

Affected products

VendorProduct
openwebuiopen_webui

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, GET /api/v1/memories/ef is accessible without authentication and executes request.app.state.EMBEDDING_FUNCTION(...). This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used. This vulnerability is fixed in 0.8.0.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-45666 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline (6.5 MEDIUM)
  • CVE-2026-45665 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline (8.1 HIGH)
  • CVE-2026-45365 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline (5.4 MEDIUM)
  • CVE-2026-45351 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline (6.5 MEDIUM)
  • CVE-2026-45350 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline (7.1 HIGH)

Same CWE

  • CVE-2026-26237 — A missing authorization vulnerability has been reported to affect QuMagie
  • CVE-2026-46518 — OpenEMR is a free and open source electronic health records and medical practice management application (7.7 HIGH)
  • CVE-2026-49956 — Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data bel... (6.5 MEDIUM)
  • CVE-2026-47281 — Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network (9.6 CRITICAL)
  • CVE-2026-49948 — Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component w... (8.1 HIGH)