Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-45301 Unauthorized File Access and Deletion in Open WebUI Prior to 0.3.16 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45301
Post summary
The post simply announces CVE-2026-45301 with a brief description of unauthorized file access and deletion, providing no evidence of PoC, exploit, or patch.
CVE-2026-45301 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related AP… https://www.cve.org/CVERecord?id=CVE-2026-45301
Post summary
The post discloses a missing permission‑check vulnerability in Open WebUI, which is fixed in v0.3.16, with no PoC, active exploitation, or debunking details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |