CVE-2026-59226: open-webui Improper Authorization

Vulnerability summary

CVE-2026-59226 is a medium (CVSS 4.3) Improper Authorization vulnerability in open-webui. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.7% of scored vulnerabilities.

Timeline

1. 09-07-2026
   PublishedVulnerability first disclosed.
2. 09-07-2026
   Last modifiedVulnerability information updated.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automations, and check_model_access only enforced private-model grants for the exact user role, allowing deactivated pending users to continue scheduled model execution. This issue is fixed in version 0.10.0.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.