CVE-2026-44554: open-webui Missing Authorization

Vulnerability summary

CVE-2026-44554 is a high (CVSS 8.1) Missing Authorization vulnerability in open-webui. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-05-2026
   PublishedVulnerability first disclosed.
2. 15-05-2026
   Last modifiedVulnerability information updated.

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/retrieval/process/web endpoint accepts a user-supplied collection_name and an overwrite query parameter (default: True). It performs no authorization check on whether the calling user owns or has write access to the target collection. When overwrite=True, save_docs_to_vector_db calls VECTOR_DB_CLIENT.delete_collection() on the target collection before writing new content. This vulnerability is fixed in 0.9.0.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.