CVE-2026-44550

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, FolderForm uses model_config = ConfigDict(extra='allow'), which permits arbitrary fields to pass through Pydantic validation and be included in model_dump(exclude_unset=True). In insert_new_folder, the server-assigned user_id is placed at the start of the dict and then overwritten by the spread of form data. Because FolderModel declares user_id: str as a real field (not just a form extra), any attacker-supplied user_id in the POST body is accepted by the model and persisted on the Folder row. This vulnerability is fixed in 0.9.0.

• CWE-862

• https://github.com/open-webui/open-webui/security/advisories/GHSA-hr43-rjmr-7wmmExploit, Mitigation, Vendor Advisory

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44545daphne before 4.2.2 did not pass maxFramePayloadSize or maxM…7.5
• CVE-2026-44546daphne before 4.2.2 reconstructs a raw HTTP request from Twi…5.3
• CVE-2026-44547ChurchCRM is an open-source church management system. From 7…9.6
• CVE-2026-44548ChurchCRM is an open-source church management system. Prior …8.1
• CVE-2026-44549Open WebUI is a self-hosted artificial intelligence platform…8.7
• CVE-2026-4455Heap buffer overflow in PDFium in Google Chrome prior to 146…8.8
• CVE-2026-44551Open WebUI is a self-hosted artificial intelligence platform…9.1
• CVE-2026-44552Open WebUI is a self-hosted artificial intelligence platform…8.7
• CVE-2026-44553Open WebUI is a self-hosted artificial intelligence platform…8.1
• CVE-2026-44554Open WebUI is a self-hosted artificial intelligence platform…8.1
• CVE-2026-44555Open WebUI is a self-hosted artificial intelligence platform…7.6
• CVE-2026-44556Open WebUI is a self-hosted artificial intelligence platform…7.1