CVE-2026-44570

🗓️ 15 May 2026 21:05:17Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 10 Views🌐 WEB

Before 0.6.19, non-admin users could view, delete, and restore others' memories, leaking content.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-44570	15 May 202621:05	–	attackerkb
Circl	CVE-2026-44570	5 May 202620:34	–	circl
CNNVD	Open WebUI 安全漏洞	15 May 202600:00	–	cnnvd
Cvelist	CVE-2026-44570 Open WebUI: Inconsistent authorization controls within memories API	15 May 202621:05	–	cvelist
EUVD	EUVD-2026-30642	15 May 202621:05	–	euvd
Github Security Blog	Open WebUI has inconsistent authorization controls within memories API	11 May 202614:25	–	github
NVD	CVE-2026-44570	15 May 202622:16	–	nvd
OSV	GHSA-HMJQ-CRXP-7RJW Open WebUI has inconsistent authorization controls within memories API	11 May 202614:25	–	osv
Positive Technologies	PT-2026-39672	11 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-44570	18 May 202613:58	–	redhatcve

NVD

Vulners

Node

openwebui open_webuiRange<0.6.19

[
  {
    "vendor": "open-webui",
    "product": "open-webui",
    "versions": [
      {
        "version": "< 0.6.19",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/open-webui/open-webui/security/advisories/GHSA-hmjq-crxp-7rjw

Parameter	Position	Path	Description	CWE
memory_id	path	api/v1/memories/{memory_id}/update	Update endpoint leaks the content of a memory when a valid memory_id is known, enabling viewing by non-admin users.	CWE-639
memory_id	path	api/v1/memories/{memory_id}	DELETE endpoint can be used by any user to delete an existing memory.	CWE-639

17 Jun 2026 10:50Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.3

EPSS0.00294

SSVC

CWE-639