CVE-2026-44570
- Source
- https://cve.org/CVERecord?id=CVE-2026-44570
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44570.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-44570
- Aliases
- Published
- 2026-05-15T21:05:17.343Z
- Modified
- 2026-07-08T08:13:29.216546052Z
- Severity
-
- 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
- Summary
- Open WebUI: Inconsistent authorization controls within memories API
- Details
-
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, authorization controls surrounding the memories API were inconsistent, resulting in the ability of a standard user to delete, restore, and view the contents of other users' memories. Using a newly created non-admin user with no existing memories, it is possible to view existing memories via POST /api/v1/memories/query. Similarly, even if a non-admin user cannot modify another user's memory data via POST /api/v1/memories/{memoryid}/update, the endpoint's response improperly leaks the content of that memory if a valid memoryid is known. The DELETE /api/v1/memories/{memoryid} can also be used by any user to delete an existing memory. Deleted memories can then be restored by calling the POST /api/v1/memories/{memoryid}/update endpoint again. This vulnerability is fixed in 0.6.19.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44570.json", "cwe_ids": [ "CWE-639" ], "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/open-webui/open-webui
Affected ranges
- Type
- GIT
- Repo
- https://github.com/open-webui/open-webui
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "source": [ "AFFECTED_FIELD", "CPE_RANGE" ], "cpe": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "0.6.19" } ] }