Unauthorized Access Flaw in Open WebUI AI Platform

CVE-2026-45667

What is CVE-2026-45667?

Open WebUI, a self-hosted AI platform, has a vulnerability in versions prior to 0.8.0 that allows unauthorized users to access sensitive API endpoints. Specifically, the GET request to /api/v1/memories/ef is not protected by authentication, enabling any unauthenticated caller to trigger the embedding generation process. This flaw poses a risk of unexpected costs if a paid embedding provider is used, as it allows unrestricted access to features meant for authenticated users. The issue is addressed in version 0.8.0, which restricts access to the API.

References