CVE-2026-45399
HighSummary
Open WebUI is an artificial intelligence platform that, prior to version 0.9.0, allowed authenticated users with low privileges to enumerate active background tasks and stop tasks belonging to other users. This represents a serious authorization vulnerability affecting integrity and usability in multi-user environments.
Risk Assessment
This vulnerability can lead to disruptions in system operation, allowing users to interrupt other users' active tasks, negatively impacting collaboration and efficiency within the organization.
Recommendation
It is recommended to upgrade to version 0.9.0 or later to eliminate this vulnerability and secure the system against unauthorized access to tasks.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate active background tasks across the system and stop tasks belonging to other users via the GET /api/tasks and POST /api/tasks/stop/{task_id} methods. This allows a casual user to disrupt system-wide chat usage by continuously canceling other users' active tasks. This is a real authorization vulnerability affecting integrity and usability in multi-user deployments. This vulnerability is fixed in 0.9.0.