CVE-2026-45675

Katalog CVE

CVSS 8.1 · High EPSS 0,51%

Kerentanan Improper Privilege Management pada openwebui open webui. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP and OAuth authentication flows use a TOCTOU (Time-of-Check-Time-of-Use) pattern for first-user admin role assignment. The regular signup handler (signup_handler in auths.py, line 663) was explicitly patched to prevent this race with the comment "Insert with default role first to avoid TOCTOU race", but the LDAP and OAuth code paths were never updated with the same fix. This vulnerability is fixed in 0.9.0.

Rincian

Terbit di NVD

15 Mei 2026

Terakhir diubah

18 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/security/advisories/GHSA-h3ww-q6xx-w7x3 exploit · mitigasi · advisory vendor
• https://github.com/open-webui/open-webui/commit/96a0b3239b1aadb23fc359bf10849c9ba12fd6ec patch
• https://github.com/open-webui/open-webui/pull/23626 issue tracking