CVE-2026-44550 Overview
CVE-2026-44550 is a mass assignment vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw exists in the FolderForm model, which permits arbitrary fields to bypass Pydantic validation. An authenticated attacker can supply a user_id value in the POST body of a folder creation request, overwriting the server-assigned identifier. The vulnerability is classified under [CWE-862] Missing Authorization and affects all versions prior to 0.9.0.
Critical Impact
Authenticated attackers can persist arbitrary user_id values on Folder records, enabling cross-tenant data manipulation and integrity violations within the Open WebUI platform.
Affected Products
- Open WebUI versions prior to 0.9.0
- Self-hosted Open WebUI deployments with folder management enabled
- All Open WebUI instances accepting authenticated POST requests to the folder creation endpoint
Discovery Timeline
- 2026-05-15 - CVE-2026-44550 published to NVD
- 2026-05-19 - Last updated in NVD database
Technical Details for CVE-2026-44550
Vulnerability Analysis
The vulnerability resides in the FolderForm Pydantic model used by Open WebUI for folder creation requests. The model declares model_config = ConfigDict(extra='allow'), which instructs Pydantic to accept arbitrary attacker-controlled fields during validation. These extra fields then propagate through model_dump(exclude_unset=True) into downstream persistence logic.
Within the insert_new_folder function, the server constructs a dictionary that places the authenticated user's user_id at the start. The form data is then spread over this dictionary, overwriting the server-assigned identifier. Because FolderModel declares user_id: str as a real field rather than an extras-only attribute, any attacker-supplied user_id is accepted by validation and persisted to the database.
The attack requires only low privileges and operates entirely over the network without user interaction. Exploitation does not yield code execution, but it breaks the tenant isolation model that Open WebUI relies on to bind folders to their owners.
Root Cause
The root cause is a combination of permissive Pydantic configuration (extra='allow') and an insecure assignment pattern where server-trusted fields are overwritten by client-supplied form data. The pattern is a textbook mass assignment flaw, where the application fails to distinguish between user-modifiable fields and server-controlled identity fields.
Attack Vector
An authenticated user submits a POST request to the folder creation endpoint with a JSON body that includes a user_id field set to an arbitrary value, such as another user's identifier. The FolderForm model accepts the field, and the spread operation in insert_new_folder overwrites the session-derived user_id. The resulting Folder row is persisted with the attacker-chosen ownership value.
The vulnerability mechanism is described in detail in the Open WebUI Security Advisory GHSA-hr43-rjmr-7wmm. No public proof-of-concept code is available at the time of publication.
Detection Methods for CVE-2026-44550
Indicators of Compromise
- Folder records in the Open WebUI database whose user_id value does not match the authenticated session that created them
- HTTP POST requests to the folder creation endpoint containing a user_id field in the JSON body
- Audit log entries showing folder creation events where the request payload includes identity fields not normally present in legitimate client traffic
Detection Strategies
- Inspect application logs for folder creation requests that include unexpected fields such as user_id, id, or created_at in the POST body
- Run database integrity queries to identify Folder rows where ownership does not align with the originating session or API token
- Compare client-submitted JSON schemas against the expected FolderForm field set and flag deviations at the reverse proxy or WAF layer
Monitoring Recommendations
- Enable verbose request logging on the Open WebUI API gateway and forward events to a centralized SIEM for analysis
- Alert on POST requests to /api/v1/folders/ containing identity-related JSON keys outside the expected schema
- Periodically reconcile folder ownership records against the user table to detect drift caused by mass assignment exploitation
How to Mitigate CVE-2026-44550
Immediate Actions Required
- Upgrade Open WebUI to version 0.9.0 or later, which removes the permissive Pydantic configuration and corrects the assignment order in insert_new_folder
- Audit existing Folder records for ownership inconsistencies and remediate any rows that show signs of mass assignment abuse
- Restrict access to the Open WebUI API to trusted users and networks until patching is complete
Patch Information
The vulnerability is fixed in Open WebUI 0.9.0. The patch is published in the Open WebUI Security Advisory GHSA-hr43-rjmr-7wmm. Administrators should upgrade using the standard container or pip update process and verify the running version after deployment.
Workarounds
- Place a reverse proxy or web application firewall in front of Open WebUI to strip user_id and other identity fields from inbound POST bodies to folder endpoints
- Disable folder creation for non-administrative users until the upgrade is applied
- Restrict Open WebUI to single-tenant deployments where cross-user impact is limited, as a temporary risk-reduction measure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
