Is CVE-2026-44571 actively exploited?

No active exploitation of CVE-2026-44571 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44571 be exploited remotely?

Yes. CVE-2026-44571 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44571?

CVE-2026-44571 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-44571

MEDIUM

CVE-2026-44571

CWE-862Published: May 15, 2026· Updated: May 18, 2026

6.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.5th

Official Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only. When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages. As a result, unauthorized modification of other users’ messages is possible. This vulnerability is fixed in 0.8.6.

NVD Source

Technical Analysis

CVE-2026-44571 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.