CVE-2026-44561: Open WebUI Auth Bypass Vulnerability

CVE-2026-44561 Overview

CVE-2026-44561 is an authorization flaw in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The is_user_channel_member function verifies that a ChannelMember row exists for a user but does not evaluate the is_active field. As a result, users removed from a group or direct message (DM) channel retain access through direct API calls. Their membership row persists with is_active=False and status='left', yet the authorization check treats them as valid members. The issue is classified as [CWE-863: Incorrect Authorization] and is fixed in version 0.9.0.

Critical Impact
Deactivated channel members keep full read and write access to channels they were removed from, enabling unauthorized data access and message injection.

Affected Products

Open WebUI versions prior to 0.9.0
Deployments exposing channel and DM functionality via API
Self-hosted instances with multi-user collaboration enabled

Discovery Timeline

2026-05-15 - CVE-2026-44561 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-44561

Vulnerability Analysis

The vulnerability resides in the channel authorization layer of Open WebUI. The is_user_channel_member function queries the database for a ChannelMember record matching the user and channel identifiers. If a row exists, the function returns true and the request proceeds. The check does not filter on the is_active field or evaluate status. Open WebUI uses soft deletion for membership records. When a channel owner removes a user, or when a user leaves voluntarily, the row remains with is_active=False and status='left'. The authorization layer therefore cannot distinguish active members from deactivated ones.

The vulnerability falls under the broader category of broken access control. Standard endpoint protection cannot prevent it because the malicious traffic uses valid credentials and well-formed API requests.

Root Cause

The root cause is an incomplete authorization predicate. The database schema supports membership state tracking through is_active and status columns, but the authorization function does not consult these fields. The result is a logic gap where soft-deleted records continue to grant access. The 0.9.0 release adds the active-state check to close the gap.

Attack Vector

An attacker requires an authenticated account that was previously a member of a target channel. After removal, the attacker bypasses the user interface and issues direct HTTP requests to channel endpoints. The API honors the requests because the membership row still exists. The attacker can read new messages posted after their removal and inject new messages back into the channel. Exploitation requires network access to the Open WebUI instance and low privileges.

No verified public proof-of-concept code is available. The security advisory for Open WebUI describes the mechanism. See the Open WebUI GitHub Security Advisory for vendor details.

Detection Methods for CVE-2026-44561

Indicators of Compromise

API requests to channel endpoints from user accounts whose ChannelMember.is_active value is False
Channel activity logs showing messages from users with status='left'
Mismatches between UI-visible membership rosters and audit logs of message authors

Detection Strategies

Query the Open WebUI database for ChannelMember rows where is_active=False and correlate with recent channel access logs
Inspect web server access logs for requests to channel and DM API routes by accounts no longer listed as active members
Establish a baseline of active members per channel and alert on deviations between roster and message authorship

Monitoring Recommendations

Forward Open WebUI application and access logs to a centralized logging or SIEM platform for retention and correlation
Monitor administrative actions that remove channel members and tag subsequent activity from those user IDs for review
Track failed and successful API calls per user to identify anomalous post-removal access patterns

How to Mitigate CVE-2026-44561

Immediate Actions Required

Upgrade Open WebUI to version 0.9.0 or later, which adds the is_active check to channel authorization
Audit existing ChannelMember records and identify users with is_active=False who accessed channels after deactivation
Rotate credentials and review channel content for any messages posted by deactivated members

Patch Information

The vendor fixed the issue in Open WebUI 0.9.0 by extending is_user_channel_member to validate the is_active field. Refer to the Open WebUI GitHub Security Advisory GHSA-hmgr-67hw-j2cq for the official advisory and patch references.

Workarounds

Where immediate upgrade is not possible, hard-delete ChannelMember rows when removing users rather than relying on soft deletion
Restrict network access to the Open WebUI API to trusted users while the upgrade is scheduled
Disable channel and DM functionality temporarily for deployments that do not require multi-user collaboration

bash

# Configuration example: upgrade Open WebUI via pip
pip install --upgrade open-webui>=0.9.0

# Verify installed version
pip show open-webui | grep Version