CVE-2026-44570: Open WebUI Inconsistent Authorization Controls in Memories API
Summary
CVE-2026-44570: Open WebUI has inconsistent authorization controls within memories API. Affects open-webui versions < 0.6.19. Fixed in 0.6.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is an open-source web application designed for managing user memories. It allows users to create, view, and manage personal memories securely. However, a recent vulnerability has been identified that exposes sensitive user data due to inconsistent authorization controls within its Memories API, potentially allowing unauthorized access to other users' memories.
Vulnerability Detail
The vulnerability arises from improper authorization checks in the Memories API, allowing standard users to delete, restore, and view the contents of other users' memories. Specifically, a non-admin user can query memories created by others using the POST /api/v1/memories/query endpoint, even if they have no memories of their own. Additionally, the DELETE and POST /api/v1/memories/{memory_id}/update endpoints can be exploited to delete and restore memories that do not belong to the user, leading to potential data leakage and unauthorized access to sensitive information.
How To Fix
Latest published version: 0.12.3 as of 22 Oct 2026
pip install --upgrade "open-webui==0.12.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.19
This is the first release that contains the fix.
pip install --upgrade "open-webui==0.6.19"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Memories API endpoints for non-admin users until the package is updated. This can be done by implementing additional authorization checks in the API routes.
Conclusion
In summary, CVE-2026-44570 presents a significant security risk in Open WebUI due to inconsistent authorization controls in the Memories API. It is crucial for users to update to the patched version 0.6.19 or later to mitigate this vulnerability and protect sensitive user data.
See every vulnerability recorded for open-webui →
FAQ
CVE-2026-44570 is a vulnerability in Open WebUI that allows unauthorized users to access and manipulate other users' memories due to inconsistent authorization controls.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive user data, potential data leakage, and the ability for users to manipulate memories that do not belong to them.
The vulnerability has a CVSS score of 8.3, indicating a high severity level that requires immediate attention.
If immediate updates are not possible, implement additional authorization checks to restrict access to the Memories API for non-admin users as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
