Open WebUI Scheduled Automation Insecure Authorization on Disabled Users (CVE-2026-59226)

Vulnerability Overview Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Description: In Open WebUI documentation, is a zero-access role used for new user registration and deactivated users. Normal HTTP routes enforce access via (which rejects ), while routes additionally require the permission. Both paths fail to account for the fact that a deactivated account can continue operations through the background automation scheduler. 1. Scheduler fails to re-verify ownership: When a stored automation expires, uses to re-verify the owner and re-enters the pipeline without re-checking if the owner is still a user/administrator or still holds the permission. Consequently, active automations continue to run even if the owner has been deactivated. 2. Model ACLs are only enforced for the exact role : The private model permissions applied by are enforced only when . Therefore, a principal passes through a branch that denies normal non-owner users. Net Effect: Deactivated accounts can continue to execute scheduled automations generated by the background worker, consuming operator-configured model credentials and accessing stored automation model IDs, even though their current role/ACL status no longer permits access via normal routes. Scope of Impact Affected Versions: Fixed Versions: Impact: Deactivated/disabled accounts continue to execute scheduled automations after access is revoked, consuming operator-configured model credentials, quotas, and shared capacity, while bypassing private model ACLs for automation-stored model IDs. Exploitation requires a previously created active automation and a subsequent transition to the state (deactivation or approval rollback), making it limited and non-interactive. It does not provide unauthorized access, account takeover, code execution, or cross-user data exfiltration. Remediation Fixed Version: aborts and logs an error unless the re-verified owner is still a user/administrator and (for non-admins) still holds the permission; thus, expired automations for deactivated or deprivileged owners no longer run. enforces model ACLs for every non-administrator role, not just the exact role ; therefore, or other unrecognized roles no longer bypass checks. Additional Information CVE ID: CVE-2026-59226 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: Low Weaknesses: - CWE-285 - CWE-862 - CWE-963 Credits: - @repository (Reporter) - Classic296 (Remediation developer) Code Block No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Open WebUI Scheduled Automation Insecure Authorization on Disabled Users (CVE-2026-59226)

More from this source