← back
CVE-2026-45666

Open WebUI: Indirect Object Reference (IDOR) in user notes

CVSS 6.5 MEDIUMEPSS 0.3%CWE-639
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.5EPSS 0.3%KEV nãoPoC Nuclei Metasploit Patch
Lifecycle
15 May 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/{note_id} endpoint lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating UUIDs. This results in unauthorized disclosure of potentially sensitive or private user data. This vulnerability is fixed in 0.8.11.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
open-webui · open-webui

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →