Missing Authorization in Open WebUI Affects Multiple Users
CVE-2026-109296

5.3MEDIUM

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109296?

The Open WebUI framework prior to version 0.11.4 contains a vulnerability that allows authenticated users to access disabled model provider backends. By manipulating the backend index with specific path segments or query parameters in OpenAI-compatible listing routes, attackers can trigger requests using configured API keys. This could potentially lead to the exposure of version strings and an enumeration of connections, posing serious risks to user data and security.

Affected Version(s)

open-webui 0 < 0.11.4

open-webui 0.11.4

References

https://github.com/open-webui/open-webui/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/open-webui-before-0....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ahkarl13
Classic298
.