CVE-2026-45666CWE-639

Open WebUI: Indirect Object Reference (IDOR) in user notes

Medium · published May 15, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/{note_id} endpoint lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating UUIDs. This results in unauthorized disclosure of potentially sensitive or private user data. This vulnerability is fixed in 0.8.11.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00389 · 31.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-15T21:07Z
EPSS history
Timeline
  • 15 MAY 21:07Z
    Open WebUI: Indirect Object Reference (IDOR) in user notes
    cvelistv5