CVE-2026-44570: Open WebUI Auth Bypass Vulnerability

CVE-2026-44570 Overview

CVE-2026-44570 is a broken access control vulnerability [CWE-639] in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw affects the memories API in versions prior to 0.6.19. Authorization checks across multiple memory endpoints are inconsistent, allowing any authenticated standard user to view, modify, delete, and restore other users' memory records. Exploitation requires only low-privilege credentials and network access to the application. The vendor fixed the issue in version 0.6.19.

Critical Impact
Authenticated low-privilege users can read, delete, and restore memory contents belonging to other users, including administrators, exposing sensitive AI conversation data stored in the platform.

Affected Products

Open WebUI versions prior to 0.6.19
Self-hosted Open WebUI deployments exposing the memories API
Multi-tenant Open WebUI instances with standard (non-admin) user accounts

Discovery Timeline

2026-05-15 - CVE-2026-44570 published to the National Vulnerability Database (NVD)
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-44570

Vulnerability Analysis

The vulnerability stems from inconsistent authorization enforcement on the memories API endpoints in Open WebUI. The application fails to verify that the authenticated user owns the memory resource being accessed. This permits cross-user data access across read, update, and delete operations.

A standard user can issue POST /api/v1/memories/query and retrieve memory entries belonging to other accounts. The POST /api/v1/memories/{memory_id}/update endpoint leaks the contents of any memory when a valid memory_id is supplied, even when the user lacks modification rights. The DELETE /api/v1/memories/{memory_id} endpoint accepts deletion requests from any authenticated user. Deleted memories can be reinstated by calling the update endpoint again, providing a restoration primitive.

Root Cause

The root cause is missing object-level authorization checks on the memories API handlers. The endpoints validate that a session is authenticated but do not confirm that the requesting user owns the referenced memory_id. This is a classic Insecure Direct Object Reference (IDOR) pattern tracked as [CWE-639].

Attack Vector

An attacker requires a valid non-admin account on the target Open WebUI instance. The attacker queries memories belonging to other users, enumerates memory identifiers, and issues update or delete requests against those identifiers. No user interaction from the victim is required, and the attack is performed entirely over the network against the application's REST API.

No public proof-of-concept code is referenced in the advisory. See the GitHub Security Advisory GHSA-hmjq-crxp-7rjw for vendor details.

Detection Methods for CVE-2026-44570

Indicators of Compromise

Unexpected DELETE /api/v1/memories/{memory_id} requests from non-admin user sessions
High volumes of POST /api/v1/memories/query calls from a single user account
POST /api/v1/memories/{memory_id}/update requests targeting memory_id values not owned by the requesting user
Memory records reappearing after deletion, indicating use of the update-based restoration path

Detection Strategies

Correlate application logs to identify users accessing memory_id values that do not match their account ownership records
Alert on access pattern anomalies where a single user touches memories across many distinct owners in a short time window
Review web server and reverse proxy logs for enumeration patterns against /api/v1/memories/ paths

Monitoring Recommendations

Forward Open WebUI application and reverse proxy logs to a centralized logging platform for retention and analysis
Track the version of Open WebUI deployed across all hosts and flag instances running versions below 0.6.19
Monitor authentication events for the creation of new low-privilege accounts followed by immediate memories API activity

How to Mitigate CVE-2026-44570

Immediate Actions Required

Upgrade Open WebUI to version 0.6.19 or later on all self-hosted instances
Audit existing memory records and user activity logs for unauthorized cross-user access prior to patching
Restrict network exposure of the Open WebUI interface to trusted users while patching is in progress
Rotate or invalidate sessions for non-admin accounts after applying the update

Patch Information

The vendor released a fix in Open WebUI version 0.6.19. The patch is documented in the GitHub Security Advisory GHSA-hmjq-crxp-7rjw. Administrators should upgrade through their standard deployment mechanism, such as pip, Docker image pull, or Kubernetes manifest update.

Workarounds

Disable standard user account creation and limit access to trusted administrators until the upgrade is applied
Place the application behind an authenticating reverse proxy that enforces additional access controls on the /api/v1/memories/ paths
Remove or empty sensitive memory contents from user accounts until the patched version is deployed

bash

# Upgrade Open WebUI to the patched version
pip install --upgrade open-webui==0.6.19

# Or for Docker deployments
docker pull ghcr.io/open-webui/open-webui:0.6.19
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui ghcr.io/open-webui/open-webui:0.6.19