CVE-2026-44571

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only. When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages. As a result, unauthorized modification of other users’ messages is possible. This vulnerability is fixed in 0.8.6.

• CWE-862

• https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjwExploit, Mitigation, Vendor Advisory
• https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjwExploit, Mitigation, Vendor Advisory

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44566Open WebUI is a self-hosted artificial intelligence platform…9.8
• CVE-2026-44567Open WebUI is a self-hosted artificial intelligence platform…7.3
• CVE-2026-44568Open WebUI is a self-hosted artificial intelligence platform…4.8
• CVE-2026-44569Open WebUI is a self-hosted artificial intelligence platform…7.1
• CVE-2026-4457Type Confusion in V8 in Google Chrome prior to 146.0.7680.15…8.8
• CVE-2026-44570Open WebUI is a self-hosted artificial intelligence platform…8.3
• CVE-2026-44572Next.js is a React framework for building full-stack web app…5.9
• CVE-2026-44573Next.js is a React framework for building full-stack web app…7.5
• CVE-2026-44574Next.js is a React framework for building full-stack web app…8.1
• CVE-2026-44575Next.js is a React framework for building full-stack web app…7.5
• CVE-2026-44576Next.js is a React framework for building full-stack web app…5.4
• CVE-2026-44577Next.js is a React framework for building full-stack web app…5.9