CVE-2026-109296 | Open WebUI up to 0.11.3 Model Provider Backend index improper authorization

October 12, 2026 Yanac

A vulnerability classified as problematic was found in Open WebUI up to 0.11.3. Affected by this issue is some unknown functionality of the component Model Provider Backend. Executing a manipulation of the argument index can lead to improper authorization.

This vulnerability appears as CVE-2026-109296. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is advised.VulDB Recent EntriesRead More