Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only. When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages. As a result, unauthorized modification of other users’ messages is possible. This vulnerability is fixed in 0.8.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-44571 Unauthorized Message Modification in Open WebUI Prior to Version 0.8.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44571
Post summary
The passage announces CVE‑2026‑44571, describing an unauthorized message modification flaw in Open WebUI versions prior to 0.8.6, without providing PoCs, exploits, patches, or evidence of active exploitation.
CVE-2026-44571 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in standard channels (i.e., channels whose channel.… https://www.cve.org/CVERecord?id=CVE-2026-44571
Post summary
The text announces CVE-2026-44571 affecting Open WebUI, indicating the issue was present before version 0.8.6 and pointing readers to the CVE record for further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |