CVE-2026-45349: Open WebUI authorization bypass in completions API

Executive brief

Open WebUI, a popular interface for interacting with large language models, contains a security flaw that allows any registered user to access and continue the private chat conversations of other users. By knowing a specific chat identifier, an unauthorized person can read sensitive information or interfere with ongoing AI interactions. This could lead to the exposure of private data or corporate secrets shared during AI sessions.

Technical details

A Broken Access Control vulnerability (CWE-639) exists in Open WebUI's completions API endpoint (/api/chat/completions). The application fails to verify if the requesting user is the owner of the Chat ID provided in the request body. An authenticated attacker can provide their own API key along with a target user's Chat ID to read or append to that user's conversation history, provided both users have access to the same underlying model. The vulnerability was addressed in version 0.9.0 by implementing an ownership check (Chats.is_chat_owner) in the backend handler.

Affected products

• Open WebUI open-webui <= 0.8.12

Timeline

• 2026-04-01: patched: First released in v0.9.0
• 2026-05-14: advisory

References

• https://api.github.com/users/savvaki
• https://github.com/savvaki
• https://api.github.com/users/savvaki/gists%7B/gist_id%7D
• https://api.github.com/users/savvaki/repos
• https://avatars.githubusercontent.com/u/86887075?v=4
• https://api.github.com/users/savvaki/events%7B/privacy%7D