Vendor
open-webui
175 known vulnerabilities.
Products
92 results · Clear filters · Feed
-
Medium 4.6
Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds
Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated u…
-
Medium 6.5
Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30…
-
Medium 6.5
Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automa…
-
Medium 6.5
Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model …
-
Medium 4.3
Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Olla…
-
Medium 4.3
Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_fil…
-
Medium 6.5
Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host…
-
Medium 6.5
Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export t…
-
Medium 6.8
Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections…
-
Medium 6.3
Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket
Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access o…
-
Medium 6.4
Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats t…
-
Medium 4.3
Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained f…
-
Medium 5.0
Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can down…
-
Medium 4.3
Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call …
-
Medium 5.4
Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent…
-
Medium 6.5
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OA…
-
Medium 6.5
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal O…
-
Medium 6.5
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries u…
-
Medium 5.0
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_RE…
-
Medium 6.5
Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to follow childrenIds w…
-
Medium 4.3
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat witho…
-
Medium 4.3
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id bu…
-
Medium 4.3
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven sh…
-
Medium 6.8
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. Wh…
-
Medium 6.5
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without i…
-
Medium 4.3
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used b…
-
Medium 4.3
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value without type validation and the shared upcoming-event sched…
-
Medium 6.5
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py let a chat participant choose…
-
Medium 6.5
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py returned full Python to…
-
Medium 6.3
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user …
-
Medium 6.5
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then w…
-
Medium 6.3
Open WebUI: DNS Rebinding SSRF Bypass
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname ag…
-
Medium 4.3
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request …
-
Medium 5.3
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticat…
-
Medium 4.3
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied image_generation flag and did not re-check the features.image_generation permis…
-
Medium 5.4CVE-2026-70481 Public exploit
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wro…
-
Medium 4.1
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resourc…
-
Medium 5.4
Open WebUI: Arena task endpoints can bypass underlying model access controls
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as …
-
Medium 5.4
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_knowledge_file_access only checked read access while file write and delete routes later trusted object-derived access through writable mode…
-
Medium 4.3
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings and non-label-boundary suffixes, allowing path-based blocklist bypasses …