Open WebUI missing authorization check at the model update function - models from other users can be updated — CVE-2026-45345

Summary

### Summary A user can modify another user's model even if its visibility is set to `Private`. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Open WebUI 0.5.4. ### Details / PoC The user `Victim` created a private model with the visibility set to…

Product

pip: open-webui

What to do

General, cautious steps (verify details in the official source):

• Review exposure and plan remediation based on risk and environment.
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Related advisories