{"data":{"id":"2ad0365d-516f-4d5d-9bef-964903b333ab","title":"CVE-2026-109296: Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach…","summary":"Open WebUI before 0.11.4 has a missing authorization flaw that lets authenticated users reach model provider backends that are disabled. By supplying an explicit backend index as a path segment or query parameter on the Ollama and OpenAI-compatible listing routes, an attacker can trigger requests carrying configured API keys, read version strings, and enumerate connections.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109296","publishedAt":"2026-10-12T17:17:23.097Z","cveId":"CVE-2026-109296","cweIds":["CWE-639"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["Open WebUI","Ollama","OpenAI-compatible APIs"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Open WebUI missing authorization lets users reach disabled model backends","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-12T18:08:44.542Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-12T18:08:48.312Z","patchAvailable":null,"disclosureDate":"2026-10-12T17:17:23.097Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}