Threats tagged 'ghsa-57q6-fvp4-pqmm'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.3%	CVE-2026-45339Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted Medium6.5EPSS 0.3%2026-05-14GCVE DatabaseCVE-2026-45339 Open WebUI versions prior to 0.9.0 have a vulnerability where API key endpoint restrictions can be bypassed by using the x-api-key header instead of the Authorization header. This allows restricted API keys to access endpoints they should be blocked from, undermining access controls and potentially allowing unauthorized use of chat/completion and admin endpoints. The issue is fixed in version 0.9.0. EPSS 0.3%Vulnerability CWE-863 #ghsa-57q6-fvp4-pqmm #pypi	GCVE Database	2026-05-14

Page 1 of 1