Advisoriesby Ibis
Open WebUI security advisories
162 advisories · 63 critical or high in 12 months · latest Sep 10
60 of 162 advisories
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchangeCVE-2026-88006fixed in 0.11.1Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutCVE-2026-87011fixed in 0.11.1Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valueCVE-2026-87012fixed in 0.11.1Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycleCVE-2026-87013fixed in 0.11.1Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notesCVE-2026-87014fixed in 0.11.1Open WebUI: A user's session cookies are sent to tool servers configured for bearer authenticationCVE-2026-87015fixed in 0.11.1Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteCVE-2026-87016fixed in 0.11.1Open WebUI: improper access controlCVE-2026-87017fixed in 0.11.1Open WebUI: Channel members can overwrite another member's message via the chat completions endpointCVE-2026-87994fixed in 0.11.1Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originCVE-2026-87995fixed in 0.11.1Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loaderCVE-2026-87996fixed in 0.11.1Open WebUI: Any authenticated user can inject chats into another user's folder via chat completionsCVE-2026-87997fixed in 0.11.1Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletionCVE-2026-87998fixed in 0.11.1Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetchCVE-2026-87999fixed in 0.11.1Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchangeCVE-2026-88005fixed in 0.9.0Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat treeCVE-2026-88000fixed in 0.11.1Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targetsCVE-2026-88001fixed in 0.11.1Open WebUI: Any authenticated user can hang the server via a cyclic chat message historyCVE-2026-88002fixed in 0.11.1Open WebUI: missing authorizationCVE-2026-70494fixed in 0.11.0Open WebUI: regular expression denial of serviceCVE-2026-70493fixed in 0.11.0Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesCVE-2026-70492fixed in 0.11.0Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpointsCVE-2026-70491fixed in 0.11.0Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role checkCVE-2026-70490fixed in 0.11.0Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsingCVE-2026-70489fixed in 0.11.0Open WebUI: DNS Rebinding SSRF BypassCVE-2026-54020fixed in 0.11.0Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadataCVE-2026-70487fixed in 0.11.0Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanupCVE-2026-70488fixed in 0.11.0Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originCVE-2026-70486fixed in 0.11.0Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLsCVE-2026-70485fixed in 0.11.0Open WebUI: Users denied the image-generation permission can still generate images via chat completionsCVE-2026-70484fixed in 0.11.0Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart renderingCVE-2026-70480fixed in 0.11.0Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpointCVE-2026-70483fixed in 0.11.0Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any clientCVE-2026-70482fixed in 0.11.0Open WebUI: Any member with write access to a standard channel can edit or delete other members' messagesCVE-2026-70481fixed in 0.11.0Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loaderCVE-2026-70479fixed in 0.11.0open-webui terminal proxy path traversal guard bypass via 9x encoded traversalCVE-2026-59221fixed in 0.10.0Open WebUI: Arena task endpoints can bypass underlying model access controlsCVE-2026-59225fixed in 0.10.0Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/deleteCVE-2026-59212fixed in 0.10.0Open WebUI: server-side request forgeryCVE-2026-59224fixed in 0.10.0Open WebUI: protection mechanism failureCVE-2026-59223fixed in 0.10.0Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentialsCVE-2026-59222fixed in 0.10.0Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id bindingCVE-2026-59215fixed in 0.10.0## Summary The `get_all_models` handlers in `routers/openai.py` and...CVE-2026-59213fixed in 0.10.0Open WebUI: missing authorizationCVE-2026-59217fixed in 0.10.0Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_idCVE-2026-59216fixed in 0.10.0Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)CVE-2026-59714fixed in 0.10.0Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logoutCVE-2026-59219fixed in 0.10.0Open WebUI: missing authenticationCVE-2026-59715fixed in 0.10.0Open WebUI: missing authorizationCVE-2026-59227fixed in 0.10.0Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configCVE-2026-59220fixed in 0.10.0Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocationCVE-2026-59226fixed in 0.10.0Open WebUI: Account enumeration via observable login timing discrepancyCVE-2026-59218fixed in 0.10.0Open WebUI: Stored web worker XSS via PyodideCVE-2026-59214fixed in 0.10.0Open WebUI: admin could restrictCVE-2026-45339fixed in 0.9.0Open WebUI has Blind Server Side Request Forgery in its Image Edit FunctionalityCVE-2026-34225no fix yetOpen WebUI vulnerable to Stored XSS via iFrame embeds in response messagesCVE-2026-26193fixed in 0.6.44Open WebUI vulnerable to Stored XSS via iFrame in citations modelCVE-2026-26192fixed in 0.7.0Open WebUI: remote code executionCVE-2025-46719fixed in 0.6.6Open WebUI allows limited stored XSS vila uploaded html fileCVE-2025-46571fixed in 0.6.6Open WebUI: Any authenticated user can read other users' private notes via Socket.IOCVE-2026-54022fixed in 0.8.11About Open WebUI
The self-hosted chat interface for local and hosted models.
Packages watched: open-webui (PyPI).