CVE-2026-44567: open webui Auth Bypass

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an authorized user role of user. By default, when Open WebUI is configured with new sign-ups enabled, the default user role is set to pending. In this configuration, an administrator is required to go into the Admin management panel following a new user registration and reconfigure the user to have a role of either user or admin before that user is able to access the web application. This vulnerability is fixed in 0.1.124.

Is your site exposed to CVE-2026-44567?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS — Exploit Prediction

0.0010

Probability of exploitation

0.27%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-602 CWE-602

CWE-863 Incorrect Authorization

Affected Products

Vendor	Product	Versions
openwebui	open_webui	< 0.1.124

References

Advisories & Patches

https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf

Exploits

https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf

Frequently Asked Questions

What is CVE-2026-44567? +

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an authorized user role of user. By default, when Open WebUI is configured with new sign-ups enabled, the default user role is set to pending. In this configuration, an administrator is required to go into the Admin management panel following a new user registration and reconfigure the user to have a role of either user or admin before that user is able to access the web application. This vulnerability is fixed in 0.1.124. It has a CVSS v3.1 base score of 7.3 (HIGH).

How severe is CVE-2026-44567? +

CVE-2026-44567 has a CVSS v3.1 score of 7.3 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0010, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-44567? +

CVE-2026-44567 affects products from openwebui, specifically: open_webui. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-44567? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-122148

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator …

CVE-2026-63301

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; …

CVE-2026-82189

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated …

CVE-2026-54047

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to …

CVE-2026-67363

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints …

CVE-2026-77026

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did …

CVE-2026-44567