CVE-2026-59227 Details
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and did not enforce the global image-edit switch or the per-user image-generation permission, allowing a non-admin user to invoke server-side image editing with administrator-configured provider credentials. This issue is fixed in version 0.10.0.
A vulnerability in Open WebUI versions 0.8.11 prior to 0.10.0 allows verified non-admin users to bypass image editing permissions and controls. The issue arises in the POST /api/v1/images/edit endpoint, which lacked proper authorization checks. While other image editing routes enforced global and per-user permissions, this direct edit route only required a verified account. As a result, non-admin users could invoke server-side image editing using administrator-configured provider credentials, even when image editing was disabled or specific permissions were denied.
Users can update to Open WebUI version 0.10.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g | CISA-ADP | ExploitVendor Advisory |
| https://github.com/open-webui/open-webui/commit/e038bab66dec8d17212eec35b5cb6d6b785a4200 | [email protected] | Patch |
| https://github.com/open-webui/open-webui/pull/26009 | [email protected] | Issue TrackingPatch |
| https://github.com/open-webui/open-webui/releases/tag/v0.10.0 | [email protected] | ProductRelease Notes |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwebui open webui | >= 0.8.11, < 0.10.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | New CVE Received | [email protected] |