CVE-2026-45345: Open WebUI Auth Bypass Vulnerability

CVE-2026-45345 Overview

CVE-2026-45345 is a broken access control vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. Versions prior to 0.5.7 allow an authenticated user to modify another user's model even when its visibility is set to Private. By altering access permissions during the model editing workflow, an attacker can gain unauthorized write access to private resources. The flaw is tracked under CWE-285: Improper Authorization and is fixed in Open WebUI 0.5.7.

Critical Impact
Authenticated users can tamper with private models belonging to other accounts, compromising the integrity of AI workloads hosted on Open WebUI.

Affected Products

Open WebUI versions prior to 0.5.7
Self-hosted Open WebUI deployments exposed to multi-user access
Open WebUI instances integrated with private model libraries

Discovery Timeline

2026-05-15 - CVE-2026-45345 published to the National Vulnerability Database (NVD)
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45345

Vulnerability Analysis

The vulnerability resides in the model editing endpoint of Open WebUI. The application validates that the requesting user is authenticated but fails to verify that the user owns the target model before applying changes. An attacker with a standard account can issue an edit request against another user's Private model and modify its access permissions, configuration, or content.

Because Open WebUI hosts user-defined AI models and prompts, unauthorized modification undermines the integrity of downstream AI outputs. The attack vector is network-based, requires low-privilege authentication, and does not require user interaction. Confidentiality is not directly impacted, but integrity loss is high because attackers can rewrite model parameters or escalate visibility settings.

Root Cause

The root cause is missing object-level authorization on the model update handler. The server treats authentication as sufficient and does not check the ownership relationship between the calling principal and the model identifier supplied in the request. This pattern aligns with CWE-285: Improper Authorization.

Attack Vector

An authenticated attacker enumerates model identifiers through the Open WebUI API and submits a crafted edit request referencing a victim's Private model. The server processes the request without enforcing ownership, allowing the attacker to change permission flags, alter system prompts, or replace model configuration. No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-gm54-m39w-grjp for vendor-published details.

Detection Methods for CVE-2026-45345

Indicators of Compromise

Unexpected changes to model ownership, visibility, or system prompt fields in the Open WebUI database
API requests to model edit endpoints where the authenticated user identifier does not match the model owner
Audit log entries showing Private models transitioning to Public visibility without owner action

Detection Strategies

Review application logs for PUT or POST requests against model management endpoints originating from non-owner accounts
Correlate authentication events with subsequent model update events to identify cross-user modifications
Run database integrity checks comparing model user_id fields against the principal that issued the most recent update

Monitoring Recommendations

Enable verbose API access logging on the Open WebUI reverse proxy and forward logs to a centralized analytics platform
Alert on bursts of model edit requests from a single account targeting multiple distinct owners
Track Open WebUI version strings across hosts to confirm patched builds are deployed

How to Mitigate CVE-2026-45345

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.5.7 or later
Audit existing models for unauthorized changes to permissions, prompts, or configuration since deployment
Rotate API keys and session tokens for accounts that may have been used to perform unauthorized edits

Patch Information

The vendor fixed the issue in Open WebUI 0.5.7. The patch enforces ownership verification on model update operations. Release details are documented in the GitHub Security Advisory GHSA-gm54-m39w-grjp.

Workarounds

Restrict Open WebUI to trusted users only until the upgrade is applied
Place the application behind an authenticating reverse proxy that limits access to administrators
Temporarily disable model sharing features or set deployments to single-user mode where feasible

bash

# Upgrade Open WebUI to the patched release
pip install --upgrade open-webui==0.5.7

# Or, for Docker deployments
docker pull ghcr.io/open-webui/open-webui:0.5.7
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 ghcr.io/open-webui/open-webui:0.5.7