CVE-2026-45345: Open WebUI missing authorization check at the model update function - models from other users can be updated

May 14, 2026 (updated May 19, 2026)

A user can modify another user’s model even if its visibility is set to Private. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Open WebUI 0.5.4.

References

github.com/advisories/GHSA-gm54-m39w-grjp
github.com/open-webui/open-webui/security/advisories/GHSA-gm54-m39w-grjp
nvd.nist.gov/vuln/detail/CVE-2026-45345

Code Behaviors & Features

Detect and mitigate CVE-2026-45345 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →