CVE-2026-44559 — open-webui
MEDIUMCVE-2026-44559 is a medium-severity (CVSS 4.3) CWE-862 vulnerability in open-webui. A fix is available for open-webui — see the affected versions and patch details below.
Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44559.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2026-44559 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 378,156 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
open-webuiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Missing Access Check on Channel Members Endpoint for Standard Channels
Affected Component
Channel members listing endpoint:
backend/open_webui/routers/channels.py(lines 445-507,get_channel_members_by_id)
Affected Versions
Current main branch and likely all versions with the channels feature.
Description
The GET /api/v1/channels/{id}/members endpoint only checks membership for group and dm channel types (lines 467-469). For standard channels — including private ones — there is no channel_has_access check before returning the member list. Any authenticated user who knows a private channel's UUID can enumerate all users with access to that channel.
# Line 467-469: only group/dm channels are checked
if channel.type in ['group', 'dm']:
if not Channels.is_user_channel_member(channel.id, user.id, db=db):
raise HTTPException(...)
# Standard channels fall through with NO access check
Compare with other channel endpoints (e.g., get_channel_messages at line 688) which correctly call channel_has_access(user.id, channel, permission='read') for standard channels.
CVSS 3.1 Breakdown
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network (N) | Exploited remotely via API call |
| Attack Complexity | Low (L) | Single API call, no special conditions |
| Privileges Required | Low (L) | Requires a valid user account |
| User Interaction | None (N) | No victim interaction required |
| Scope | Unchanged (U) | Impact is within the channel authorization boundary |
| Confidentiality | Low (L) | Leaks user identities and details for a private channel |
| Integrity | None (N) | No data modification |
| Availability | None (N) | No denial of service |
Attack Scenario
- Attacker obtains a private standard channel's UUID (via logs, browser history, URL observation, or other API responses).
- Attacker calls
GET /api/v1/channels/{id}/members. - The server returns the full list of permitted users including their IDs, names, emails, roles, and profile images.
- The attacker has no access to the channel's messages (those endpoints check access correctly), but now knows exactly who does.
Impact
- Leaks the identity and personal details of every user with access to a private channel
- Reveals organizational structure and project assignments
- Enables targeted social engineering against channel members
Preconditions
- Channels feature must be enabled (disabled by default)
- Attacker must know the channel UUID (not guessable, but obtainable through indirect means)
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | open-webui | all versions | 0.9.0pip install --upgrade 'open-webui==0.9.0' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for open-webui, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update open-webui to 0.9.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44559 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-44559 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-44559. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-44559 in your dependencies?
O3 Security finds CVE-2026-44559 across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.