CVE-2026-44555
- Source
- https://cve.org/CVERecord?id=CVE-2026-44555
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44555.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-44555
- Aliases
- Published
- 2026-05-15T19:48:35.352Z
- Modified
- 2026-07-08T08:13:29.797420554Z
- Severity
-
- 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
- Summary
- Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining
- Details
-
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via basemodelid: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed model, the access control pipeline verifies the user has access to the composed model but never re-verifies access to the chained base model. Additionally, the model creation and import endpoints accept arbitrary basemodelid values without checking that the caller has access to that base model. Combined, this allows any user with the default model creation permission to create a model that chains to a restricted base model — and then invoke it, causing the server to dispatch the request to the restricted base model using the admin-configured API key. This vulnerability is fixed in 0.9.0.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44555.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-862" ] }- References
Affected packages
Git / github.com/open-webui/open-webui
Affected ranges
- Type
- GIT
- Repo
- https://github.com/open-webui/open-webui
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "source": [ "AFFECTED_FIELD", "CPE_RANGE" ], "cpe": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "0.9.0" } ] }