- Latest release
- 0.13.0 (Nov 3, 2026): no advisory affects it
- Newest unaffected release
- 0.13.0 (Nov 3, 2026), the latest release
- Advisories
- 149 · 2 critical, 66 high, 74 medium, 7 low
- Weekly downloads
- 158.6K
- Dependents
- 2
- Releases
- 173 since 0.1.124 (May 20, 2024)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-88006Affects 0.8.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-88005Affects 0.8.0 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-88002Affects 0.5.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-88001Affects 0.9.5 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-88000Affects 0.10.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87999Affects 0.1.124 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87998Affects 0.10.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87997Affects 0.10.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87996Affects 0.9.6 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87995Affects 0.8.11 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87994Affects 0.9.5 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87017Affects 0.7.0 to 0.11.0 (0.11.1 is outside it)
Show all 149 advisoriesShow fewer advisories
- CVE-2026-87016Affects 0.6.41 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87015Affects 0.6.27 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87014Affects 0.9.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87013Affects 0.10.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87012Affects 0.9.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87011Affects 0.9.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-59714Affects 0.9.5 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-70494Affects 0.10.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70493Affects 0.9.6 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70492Affects 0.10.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70491Affects 0.1.124 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70490Affects 0.8.8 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70489Affects 0.9.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-54020Affects 0.1.124 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70488Affects 0.9.6 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70487Affects 0.8.8 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70486Affects 0.9.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70485Affects 0.9.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70484Affects 0.7.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70483Affects 0.9.6 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70482Affects 0.8.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70481Affects 0.5.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70480Affects 0.6.34 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70479Affects 0.9.6 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-56400Affects 0.1.124 to 0.3.33.dev1 (0.3.33 is outside it)
- CVE-2026-56398Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-59221Affects 0.9.6 (0.10.0 is outside it)
- CVE-2026-59225Affects 0.8.12 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59224Affects 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59212Affects 0.9.6 (0.10.0 is outside it)
- CVE-2026-59223Affects 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59222Affects 0.7.0 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59215Affects 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59213Affects 0.6.27 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59217Affects 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59216Affects 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59219Affects 0.9.0 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59715Affects 0.6.16 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59220Affects 0.9.2 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59226Affects 0.9.0 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59227Affects 0.8.11 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59218Affects 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59214Affects 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-54007Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54006Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54008Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54009Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54010Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54011Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54012Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54013Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54014Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54015Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54016Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54018Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54019Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54021Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54022Affects 0.1.124 to 0.8.10 (0.8.11 is outside it)
- CVE-2026-54017Affects 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-45338Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44549Affects 0.1.124 to 0.7.2 (0.8.0 is outside it)
- CVE-2026-45299Affects 0.1.124 to 0.7.2 (0.8.0 is outside it)
- CVE-2026-45667Affects 0.1.124 to 0.7.2 (0.8.0 is outside it)
- CVE-2026-44565Affects 0.1.124 to 0.6.9 (0.6.10 is outside it)
- CVE-2026-45314Affects 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-45316Affects 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-45317Affects 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-45318Affects 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-45315Affects 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-44571Affects 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-45350Affects 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-45303Affects 0.1.124 to 0.6.4 (0.6.5 is outside it)
- CVE-2026-45301Affects 0.1.124 to 0.3.15 (0.3.16 is outside it)
- CVE-2026-45345Affects 0.1.124 to 0.5.6 (0.5.7 is outside it)
- CVE-2026-45347Affects 0.1.124 to 0.5.10 (0.5.11 is outside it)
- CVE-2026-45351Affects 0.1.124 to 0.8.8 (0.8.9 is outside it)
- CVE-2026-45666Affects 0.1.124 to 0.8.10 (0.8.11 is outside it)
- CVE-2026-45365Affects 0.1.124 to 0.8.10 (0.8.11 is outside it)
- CVE-2026-44570Affects 0.1.124 to 0.6.18 (0.6.19 is outside it)
- CVE-2026-44569Affects 0.1.124 to 0.6.18 (0.6.19 is outside it)
- CVE-2026-44566No published release is affectedNo published release is affected
- CVE-2026-44567No published release is affectedNo published release is affected
- CVE-2026-45672Affects 0.1.124 to 0.8.11 (0.8.12 is outside it)
- CVE-2026-45400Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45402Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45401Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45386Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45398Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45397Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45396Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45387Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45385Affects 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-44721Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44550Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44551Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44552Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44553Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44554Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44555Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44556Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44557Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44558Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44559Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44560Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44561Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44562Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44563Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44564Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44568Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45331Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45339Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45349Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45399Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45671Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45675Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-34225Affects 0.1.124 to 0.7.2 (0.8.0 is outside it)
- CVE-2026-34222Affects 0.1.124 to 0.8.10 (0.8.11 is outside it)
- CVE-2026-29071Affects 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-29070Affects 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-28788Affects 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-28786Affects 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-26193Affects 0.1.124 to 0.6.43 (0.7.0 is outside it)
- CVE-2026-26192Affects 0.1.124 to 0.6.43 (0.7.0 is outside it)
- CVE-2025-65958Affects 0.1.124 to 0.6.36 (0.6.37 is outside it)
- CVE-2025-63681Affects 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2025-64496Affects 0.1.124 to 0.6.34 (0.6.35 is outside it)
- CVE-2025-64495Affects 0.1.124 to 0.6.34 (0.6.35 is outside it)
- CVE-2025-46719Affects 0.1.124 to 0.6.6.dev1 (0.6.6 is outside it)
- CVE-2025-46571Affects 0.1.124 to 0.6.6.dev1 (0.6.6 is outside it)
- GHSA-W466-2WFC-8G58Affects 0.1.124 to 0.5.7 (0.5.8 is outside it)
- CVE-2024-8053Affects 0.1.124 to 0.5.12 (0.5.13 is outside it)
- CVE-2024-7043Affects 0.1.124 to 0.3.15 (0.3.16 is outside it)
- CVE-2024-7983Affects 0.1.124 to 0.5.12 (0.5.13 is outside it)
- CVE-2024-7044Affects 0.1.124 to 0.3.33.dev1 (0.3.33 is outside it)
- CVE-2024-7035Affects 0.1.124 to 0.3.15 (0.3.16 is outside it)
- CVE-2024-7041Affects 0.1.124 to 0.6.2 (0.6.3 is outside it)
- CVE-2024-6706Affects 0.1.124 to 0.3.13 (0.3.14 is outside it)
Advisories 149
- CVE-2026-88006Medium 6.5
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Affected: from 0.8.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 16 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-88005Medium 6.5
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
Affected: from 0.8.0, fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 142 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-88002Medium 6.5
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Affected: from 0.5.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-88001Medium 5.0
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
Affected: from 0.9.5, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-88000Medium 6.5
Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
Affected: from 0.10.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87999High 7.1
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Affected: fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87998High 7.1
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Affected: from 0.10.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87997Medium 4.3
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
Affected: from 0.10.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87996High 7.7
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Affected: from 0.9.6, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87995High 8.7
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Affected: from 0.8.11, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87994Medium 4.3
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Affected: from 0.9.5, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87017Medium 4.3
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Affected: from 0.7.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87016High 8.1
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
Affected: from 0.6.41, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87015Medium 6.8
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
Affected: from 0.6.27, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87014Medium 6.5
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Affected: from 0.9.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
Show all 149 advisoriesShow fewer advisories
- CVE-2026-87013Medium 4.3
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
Affected: from 0.10.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87012Medium 4.3
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Affected: from 0.9.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-87011High 7.5
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
Affected: from 0.9.0, fixed in 0.11.1.
Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59714High 7.1
Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Affected: from 0.9.5, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 45 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70494High 8.1
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
Affected: from 0.10.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70493Medium 6.5
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
Affected: from 0.9.6, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70492High 8.7
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Affected: from 0.10.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70491Medium 6.5
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Affected: fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70490Medium 6.3
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Affected: from 0.8.8, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70489Medium 6.5
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Affected: from 0.9.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54020Medium 6.3
Open WebUI: DNS Rebinding SSRF Bypass
Affected: fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70488Medium 4.3
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Affected: from 0.9.6, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70487Medium 5.3
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
Affected: from 0.8.8, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70486High 8.2
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
Affected: from 0.9.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70485High 7.1
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Affected: from 0.9.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70484Medium 4.3
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
Affected: from 0.7.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70483Low 3.1
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
Affected: from 0.9.6, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70482High 8.1
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Affected: from 0.8.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70481Medium 5.4
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
Affected: from 0.5.0, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70480Medium 4.1
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
Affected: from 0.6.34, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-70479High 7.7
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
Affected: from 0.9.6, fixed in 0.11.0.
Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-56400Critical 9.0
open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
Affected: fixed in 0.3.33.
Fixed in 0.3.33 (released Oct 24, 2024, 629 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-56398High 8.5
Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 66 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59221High 7.7
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
Affected: from 0.9.6, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59225Medium 5.4
Open WebUI: Arena task endpoints can bypass underlying model access controls
Affected: from 0.8.12, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59224High 8.0
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal…
Affected: fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59212Medium 5.4
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Affected: from 0.9.6, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59223Medium 4.3
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
Affected: fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59222Medium 6.0
Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
Affected: from 0.7.0, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59215Low 3.1
Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding
Affected: fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59213Low 3.5
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
Affected: from 0.6.27, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59217Medium 4.3
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Affected: fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59216High 7.7
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
Affected: fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59219High 7.1
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
Affected: from 0.9.0, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59715Low 3.1
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
Affected: from 0.6.16, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59220Medium 6.5
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
Affected: from 0.9.2, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59226Low 3.1
Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation
Affected: from 0.9.0, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59227Medium 4.3
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
Affected: from 0.8.11, fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59218Medium 5.3
Open WebUI: Account enumeration via observable login timing discrepancy
Affected: fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-59214High 7.3
Open WebUI: Stored web worker XSS via Pyodide
Affected: fixed in 0.10.0.
Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54007High 7.1
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54006Medium 4.3
Open WebUI: Calendar event re-parenting allows writing events into another user's calendar
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54008High 8.5
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54009Medium 6.5
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54010High 8.3
Open WebUI: Forged chat-file link allows cross-user file read and deletion
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54011High 8.7
Open WebUI: Stored XSS in Mermaid Markdown Preview
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54012High 7.1
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54013High 7.6
Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54014Medium 4.3
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54015Medium 6.4
Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54016Medium 4.3
Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54018High 7.7
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54019Medium 6.5
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54021Medium 6.3
Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54022Medium 5.3
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Affected: fixed in 0.8.11.
Fixed in 0.8.11 (released Mar 25, 2026, 90 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-54017High 7.7
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
Affected: fixed in 0.9.6.
Fixed in 0.9.6 (released Jun 1, 2026, 17 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45338High 7.7
Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44549High 7.3
Open WebUI: Stored XSS in excel file preview
Affected: fixed in 0.8.0.
Fixed in 0.8.0 (released Feb 12, 2026, 92 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45299Medium 5.4
Open WebUI: Stored Cross-Site Scripting In Profile Picture
Affected: fixed in 0.8.0.
Fixed in 0.8.0 (released Feb 12, 2026, 92 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45667Medium 6.5
Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)
Affected: fixed in 0.8.0.
Fixed in 0.8.0 (released Feb 12, 2026, 92 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44565High 8.1
Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal
Affected: fixed in 0.6.10.
Fixed in 0.6.10 (released May 19, 2025, 361 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45314High 7.4
Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
Affected: fixed in 0.9.3.
Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45316Low 3.5
Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)
Affected: fixed in 0.9.3.
Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45317Medium 4.6
Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation
Affected: fixed in 0.9.3.
Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45318Medium 5.4
Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
Affected: fixed in 0.9.3.
Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45315High 8.7
Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Affected: fixed in 0.9.3.
Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44571Medium 6.5
Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission
Affected: fixed in 0.8.6.
Fixed in 0.8.6 (released Mar 1, 2026, 75 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45350High 7.1
Open WebUI: Chat completion API allows tool restrictions to be bypassed
Affected: fixed in 0.8.6.
Fixed in 0.8.6 (released Mar 1, 2026, 75 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45303High 7.7
Open WebUI: Stored XSS via the HTML renedering view
Affected: fixed in 0.6.5.
Fixed in 0.6.5 (released Apr 14, 2025, 396 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45301High 8.1
Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
Affected: fixed in 0.3.16.
Fixed in 0.3.16 (released Aug 27, 2024, 626 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45345Medium 6.5
Open WebUI: Missing authorization check at the model update function - models from other users can be updated
Affected: fixed in 0.5.7.
Fixed in 0.5.7 (released Jan 23, 2025, 477 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45347Medium 4.3
Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function
Affected: fixed in 0.5.11.
Fixed in 0.5.11 (released Feb 13, 2025, 456 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45351Medium 6.5
Open WebUI: Exposure of System Prompt to Regular User [Non-Admin]
Affected: fixed in 0.8.9.
Fixed in 0.8.9 (released Mar 8, 2026, 68 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45666Medium 6.5
Open WebUI: Indirect Object Reference (IDOR) in user notes
Affected: fixed in 0.8.11.
Fixed in 0.8.11 (released Mar 25, 2026, 51 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45365Medium 5.4
Open WebUI: Authenticated users can bypass model access control via exposed query parameter
Affected: fixed in 0.8.11.
Fixed in 0.8.11 (released Mar 25, 2026, 51 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44570High 8.3
Open WebUI: Inconsistent authorization controls within memories API
Affected: fixed in 0.6.19.
Fixed in 0.6.19 (released Aug 9, 2025, 279 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44569High 7.1
Open WebUI: Insecure Message Access Breaks Authorization
Affected: fixed in 0.6.19.
Fixed in 0.6.19 (released Aug 9, 2025, 279 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44566High 7.3
Open WebUI: Arbitrary File Upload and Path Traversal
Affected: fixed in 0.1.124.
Fixed in 0.1.124 (released May 20, 2024, 725 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44567High 7.3
Open WebUI: Open WebUI Improper Authorization Control
Affected: fixed in 0.1.124.
Fixed in 0.1.124 (released May 20, 2024, 725 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45672High 8.8
Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
Affected: fixed in 0.8.12.
Fixed in 0.8.12 (released Mar 27, 2026, 49 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45400High 8.5
Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url`
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45402High 8.1
Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45401High 8.5
Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45386Medium 4.3
Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45398High 7.5
Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45397Medium 5.3
Open WebUI: Unauthenticated RAG Configuration Disclosure
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45396Medium 5.4
Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45387Medium 4.3
Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45385Medium 4.3
Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint
Affected: fixed in 0.9.5.
Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44721High 7.3
Open WebUI: Stored XSS via Model Description
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44550Medium 5.0
Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44551Critical 9.1
Open WebUI: LDAP Empty Password Authentication Bypass
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44552High 8.7
Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44553High 8.1
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44554High 8.1
Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44555High 7.6
Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44556High 7.1
Open WebUI: responses passthrough endpoint lacks access control authorization
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44557Medium 4.3
Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44558Medium 5.4
Open WebUI: Channel Access Grants Bypass filter_allowed_access_grants
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44559Medium 4.3
Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44560Medium 6.5
Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44561Medium 5.4
Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44562Medium 6.5
Open WebUI: Model Import Overwrites Any Model Without Ownership Check
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44563Medium 5.4
Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44564Medium 5.4
Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-44568Medium 4.8
Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45331High 8.5
Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45339Medium 6.5
Open WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45349High 7.1
Open WebUI: Broken Access Control for Completions API
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45399High 7.1
Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45671High 8.0
Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-45675High 8.1
Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-34225Medium 4.3
Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
Affected: through 0.7.2.
Fixed in 0.8.0 (released Feb 12, 2026, 61 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.13.0, is not affected.
- CVE-2026-34222High 7.7
Open WebUI has Broken Access Control in Tool Valves
Affected: fixed in 0.8.11.
Fixed in 0.8.11 (released Mar 25, 2026, 7 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-29071Low 3.1
Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
Affected: fixed in 0.8.6.
Fixed in 0.8.6 (released Mar 1, 2026, 25 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-29070Medium 5.4
Open WebUI has unauthorized deletion of knowledge files
Affected: fixed in 0.8.6.
Fixed in 0.8.6 (released Mar 1, 2026, 25 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-28788High 7.1
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Affected: fixed in 0.8.6.
Fixed in 0.8.6 (released Mar 1, 2026, 25 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-28786Medium 4.3
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
Affected: fixed in 0.8.6.
Fixed in 0.8.6 (released Mar 1, 2026, 25 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2026-26193High 7.3
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
Affected: fixed in 0.6.44.
Fixed in 0.7.0 (released Jan 9, 2026, 41 days before disclosure, the advisory names 0.6.44, which was never published).
The latest release, 0.13.0, is not affected.
- CVE-2026-26192High 7.3
Open WebUI vulnerable to Stored XSS via iFrame in citations model
Affected: fixed in 0.7.0.
Fixed in 0.7.0 (released Jan 9, 2026, 41 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2025-65958High 8.5
Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
Affected: fixed in 0.6.37.
Fixed in 0.6.37 (released Nov 24, 2025, 10 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2025-63681Medium 4.3
open-webui v0.6.33 is vulnerable to Incorrect Access Control.
Affected: through 0.6.33; fixed in 0.9.0.
Fixed in 0.9.0 (released Apr 21, 2026, 138 days after disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2025-64496High 7.3
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Affected: fixed in 0.6.35.
Fixed in 0.6.35 (released Nov 6, 2025, 2 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2025-64495High 8.7
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Affected: fixed in 0.6.35.
Fixed in 0.6.35 (released Nov 6, 2025, 2 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2025-46719Medium 5.4
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via…
Affected: fixed in 0.6.6.
Fixed in 0.6.6 (released May 5, 2025, the day of disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2025-46571Medium 5.3
Open WebUI vulnerable to limited stored XSS vila uploaded html file
Affected: fixed in 0.6.6.
Fixed in 0.6.6 (released May 5, 2025, the day of disclosure).
The latest release, 0.13.0, is not affected.
Open WebUI has vulnerable dependency on starlette via fastapi
Affected: fixed in 0.5.8.
Fixed in 0.5.8 (released Feb 5, 2025, 43 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2024-8053High 7.5
Improper Authentication in open-webui/open-webui
Affected: through 0.3.10; fixed in 0.5.13.
Fixed in 0.5.13 (released Feb 18, 2025, 30 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2024-7043High 8.1
Improper Access Control in open-webui/open-webui
Affected: through 0.3.8; fixed in 0.3.16.
Fixed in 0.3.16 (released Aug 27, 2024, 205 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2024-7983High 7.5
Denial of Service in open-webui/open-webui
Affected: through 0.3.8; fixed in 0.5.13.
Fixed in 0.5.13 (released Feb 18, 2025, 30 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2024-7044Medium 6.8
Stored XSS in open-webui/open-webui
Affected: through 0.3.8; fixed in 0.3.33.
Fixed in 0.3.33 (released Oct 24, 2024, 147 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2024-7035Medium 6.9
Cross-Site Request Forgery (CSRF) in open-webui/open-webui
Affected: through 0.3.8; fixed in 0.3.16.
Fixed in 0.3.16 (released Aug 27, 2024, 205 days before disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2024-7041Medium 6.5
IDOR in open-webui/open-webui
Affected: fixed in 0.6.3.
Fixed in 0.6.3 (released Apr 13, 2025, 186 days after disclosure).
The latest release, 0.13.0, is not affected.
- CVE-2024-6706Medium 6.3
Open WebUI Stored Cross-Site Scripting
Affected: fixed in 0.3.14.
Fixed in 0.3.14 (released Aug 21, 2024, 14 days after disclosure).
The latest release, 0.13.0, is not affected.