CVE-2026-59226
EUVD-2026-4262009.07.2026, 17:17
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automations, and check_model_access only enforced private-model grants for the exact user role, allowing deactivated pending users to continue scheduled model execution. This issue is fixed in version 0.10.0.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openwebui | open_webui | 0.9.0 ≤ 𝑥 < 0.10.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration