VULNERABILITY INTELLIGENCE

CVE-2026-54019

CVSS score6.5 MEDIUM

EPSS probability0.26%

CISA KEVNot currently listed

Published2026-06-23

Last modified2026-06-25

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephe…