What is the CVSS score of CVE-2026-59226?

CVE-2026-59226 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-59226?

Yes, a patch is available for CVE-2026-59226. Update the affected software to the latest version immediately.

Open WebUI CVE-2026-59226

EUVD-2026-42620 MEDIUM

Improper Authorization (CWE-285)

2026-07-09 GitHub_M

GHSA-mvx4-532p-xfm9

Authentication Bypass Open Webui

4.3

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

LOW

qualitative

NVD

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.2 MEDIUM

AC:H reflects multi-step precondition chain; PR:L for prior authenticated account; I:L added because unauthorized scheduled execution represents an integrity violation beyond mere resource consumption.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Severity Changed

Jul 10, 2026 - 02:52 NVD

LOW MEDIUM

CVSS changed

Jul 10, 2026 - 02:52 NVD

3.1 (LOW) 4.3 (MEDIUM)

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:21 vuln.today

DescriptionNVD

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automations, and check_model_access only enforced private-model grants for the exact user role, allowing deactivated pending users to continue scheduled model execution. This issue is fixed in version 0.10.0.

AnalysisAI

Improper authorization in Open WebUI 0.9.x allows deactivated or pending users to continue executing scheduled AI model automations after their accounts should have lost that capability. The execute_automation function rehydrated automation owners without re-verifying that the owner account was still active or still held the features.automations permission, and check_model_access enforced private-model grants only against the current user role at the time of check rather than re-validating eligibility at execution time. No public exploit has been identified at time of analysis, and the CVSS score of 3.1 reflects the low real-world severity: high attack complexity, limited availability impact, and no confidentiality or integrity impact per the official assessment.

Technical ContextAI

Open WebUI (cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*) is a self-hosted AI platform supporting scheduled automations that invoke language models on behalf of users. The root cause is CWE-285 (Improper Authorization): the execute_automation code path performed object rehydration of the automation's owner context at scheduling time but omitted a live re-check of account status and feature entitlements before execution. Similarly, check_model_access validated private-model grants against the user's role as stored, not as currently enforced, allowing role changes or account deactivation to go unrecognized during the authorization gate. This is a classic stale-authorization pattern where trust decisions are made on cached or previously-verified state rather than current ground truth.

RemediationAI

Upgrade to Open WebUI v0.10.0, which resolves the issue by adding live user-status and feature-entitlement re-checks within execute_automation and correcting the role-scoped model access enforcement in check_model_access. The fix is confirmed by GitHub commit 920b655f4689e2118de928fbc936f6ebd4fed396 and pull request #26047 (https://github.com/open-webui/open-webui/pull/26047). For operators unable to upgrade immediately, a compensating control is to purge or manually disable all pending/deactivated user automations from the admin console before those accounts are deactivated - this eliminates the stale automation entries that the vulnerable code path would otherwise rehydrate. Note that this manual step must be repeated for every future deactivation event until the patch is applied, introducing operational overhead. There is no indication from available data that disabling specific network endpoints or ports would mitigate this issue, as it is a server-side logic flaw in scheduled execution.