CVE-2026-45395

🗓️ 15 May 2026 20:33:02Reported by MendType

mend🔗 www.mend.io👁 1 Views

Missing permission check in Open WebUI tool update endpoint allows replacing Python content.

Reporter	Title	Published	Views	Family All 16
attackerkb	CVE-2026-45395	15 May 202620:33	–	attackerkb
BDU FSTEC	The vulnerability of the Open WebUI web interface, based on artificial intelligence, arises from the lack of permission checks. This allows attackers to gain read access, modify data, enhance their privileges, and execute arbitrary code.	25 May 202600:00	–	bdu_fstec
Circl	CVE-2026-45395	10 May 202619:34	–	circl
CNNVD	Open WebUI 安全漏洞	15 May 202600:00	–	cnnvd
CVE	CVE-2026-45395	15 May 202620:33	–	cve
Cvelist	CVE-2026-45395 Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution	15 May 202620:33	–	cvelist
EUVD	EUVD-2026-30627	15 May 202620:33	–	euvd
Github Security Blog	Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution	14 May 202620:26	–	github
NVD	CVE-2026-45395	15 May 202621:16	–	nvd
OSV	GHSA-P4FX-23FQ-JFG6 Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution	14 May 202620:26	–	osv

Vulners

Node

openwebui open_webuiRange0.1.102–0.9.5

Source	Link
github	www.github.com/open-webui/open-webui/releases/tag/v0.9.5
github	www.github.com/open-webui/open-webui/security/advisories/GHSA-p4fx-23fq-jfg6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45395
github	www.github.com/open-webui/open-webui
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45395.json

07 Oct 2026 22:48Current

CVSS 3.17.2

CVSS 48.6

EPSS0.00659

SSVC

CWE-269 CWE-862

Open WebUI POST /api/v1/tools/id/{id}/update missing permission check Python content replacement security boundary bypass