open-webui vulnerabilities

CVEs whose affected-version data names the open-webui package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

124 CVEsRSS

CVE-2026-59714High· 7.1

1mo ago

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM ch…

open-webui vulnerabilities

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

Open WebUI: Arena task endpoints can bypass underlying model access controls

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

Open WebUI: Stored web worker XSS via Pyodide

Open WebUI: Account enumeration via observable login timing discrepancy

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI allows limited stored XSS vila uploaded html file

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

Open WebUI vulnerable to Stored XSS via iFrame in citations model

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI: Forged chat-file link allows cross-user file read and deletion

Open WebUI: Stored XSS in Mermaid Markdown Preview

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}