# open-webui (PyPI) vulnerabilities

149 known vulnerabilities (2 critical, 66 high, 74 medium, 7 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 0.13.0 (Nov 3, 2026): no advisory affects it
- Newest unaffected release: 0.13.0 (Nov 3, 2026), the latest release
- Weekly downloads: 158.6K
- Dependents: 2
- Releases: 173 since 0.1.124 (May 20, 2024)
- Registry: https://pypi.org/project/open-webui/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-88006: 0.8.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-88005: 0.8.0 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-88002: 0.5.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-88001: 0.9.5 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-88000: 0.10.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87999: 0.1.124 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87998: 0.10.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87997: 0.10.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87996: 0.9.6 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87995: 0.8.11 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87994: 0.9.5 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87017: 0.7.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87016: 0.6.41 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87015: 0.6.27 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87014: 0.9.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87013: 0.10.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87012: 0.9.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-87011: 0.9.0 to 0.11.0 (0.11.1 is outside it)
- CVE-2026-59714: 0.9.5 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-70494: 0.10.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70493: 0.9.6 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70492: 0.10.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70491: 0.1.124 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70490: 0.8.8 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70489: 0.9.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-54020: 0.1.124 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70488: 0.9.6 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70487: 0.8.8 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70486: 0.9.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70485: 0.9.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70484: 0.7.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70483: 0.9.6 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70482: 0.8.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70481: 0.5.0 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70480: 0.6.34 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-70479: 0.9.6 to 0.10.2 (0.11.0 is outside it)
- CVE-2026-56400: 0.1.124 to 0.3.33.dev1 (0.3.33 is outside it)
- CVE-2026-56398: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-59221: 0.9.6 (0.10.0 is outside it)
- CVE-2026-59225: 0.8.12 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59224: 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59212: 0.9.6 (0.10.0 is outside it)
- CVE-2026-59223: 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59222: 0.7.0 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59215: 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59213: 0.6.27 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59217: 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59216: 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59219: 0.9.0 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59715: 0.6.16 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59220: 0.9.2 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59226: 0.9.0 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59227: 0.8.11 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59218: 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-59214: 0.1.124 to 0.9.6 (0.10.0 is outside it)
- CVE-2026-54007: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54006: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54008: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54009: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54010: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54011: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54012: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54013: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54014: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54015: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54016: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54018: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54019: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54021: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-54022: 0.1.124 to 0.8.10 (0.8.11 is outside it)
- CVE-2026-54017: 0.1.124 to 0.9.5 (0.9.6 is outside it)
- CVE-2026-45338: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44549: 0.1.124 to 0.7.2 (0.8.0 is outside it)
- CVE-2026-45299: 0.1.124 to 0.7.2 (0.8.0 is outside it)
- CVE-2026-45667: 0.1.124 to 0.7.2 (0.8.0 is outside it)
- CVE-2026-44565: 0.1.124 to 0.6.9 (0.6.10 is outside it)
- CVE-2026-45314: 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-45316: 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-45317: 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-45318: 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-45315: 0.1.124 to 0.9.2 (0.9.3 is outside it)
- CVE-2026-44571: 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-45350: 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-45303: 0.1.124 to 0.6.4 (0.6.5 is outside it)
- CVE-2026-45301: 0.1.124 to 0.3.15 (0.3.16 is outside it)
- CVE-2026-45345: 0.1.124 to 0.5.6 (0.5.7 is outside it)
- CVE-2026-45347: 0.1.124 to 0.5.10 (0.5.11 is outside it)
- CVE-2026-45351: 0.1.124 to 0.8.8 (0.8.9 is outside it)
- CVE-2026-45666: 0.1.124 to 0.8.10 (0.8.11 is outside it)
- CVE-2026-45365: 0.1.124 to 0.8.10 (0.8.11 is outside it)
- CVE-2026-44570: 0.1.124 to 0.6.18 (0.6.19 is outside it)
- CVE-2026-44569: 0.1.124 to 0.6.18 (0.6.19 is outside it)
- CVE-2026-44566: no published release is affected
- CVE-2026-44567: no published release is affected
- CVE-2026-45672: 0.1.124 to 0.8.11 (0.8.12 is outside it)
- CVE-2026-45400: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45402: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45401: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45386: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45398: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45397: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45396: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45387: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-45385: 0.1.124 to 0.9.4 (0.9.5 is outside it)
- CVE-2026-44721: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44550: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44551: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44552: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44553: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44554: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44555: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44556: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44557: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44558: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44559: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44560: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44561: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44562: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44563: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44564: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-44568: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45331: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45339: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45349: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45399: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45671: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-45675: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2026-34225: 0.1.124 to 0.7.2 (0.8.0 is outside it)
- CVE-2026-34222: 0.1.124 to 0.8.10 (0.8.11 is outside it)
- CVE-2026-29071: 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-29070: 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-28788: 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-28786: 0.1.124 to 0.8.5 (0.8.6 is outside it)
- CVE-2026-26193: 0.1.124 to 0.6.43 (0.7.0 is outside it)
- CVE-2026-26192: 0.1.124 to 0.6.43 (0.7.0 is outside it)
- CVE-2025-65958: 0.1.124 to 0.6.36 (0.6.37 is outside it)
- CVE-2025-63681: 0.1.124 to 0.8.12 (0.9.0 is outside it)
- CVE-2025-64496: 0.1.124 to 0.6.34 (0.6.35 is outside it)
- CVE-2025-64495: 0.1.124 to 0.6.34 (0.6.35 is outside it)
- CVE-2025-46719: 0.1.124 to 0.6.6.dev1 (0.6.6 is outside it)
- CVE-2025-46571: 0.1.124 to 0.6.6.dev1 (0.6.6 is outside it)
- GHSA-W466-2WFC-8G58: 0.1.124 to 0.5.7 (0.5.8 is outside it)
- CVE-2024-8053: 0.1.124 to 0.5.12 (0.5.13 is outside it)
- CVE-2024-7043: 0.1.124 to 0.3.15 (0.3.16 is outside it)
- CVE-2024-7983: 0.1.124 to 0.5.12 (0.5.13 is outside it)
- CVE-2024-7044: 0.1.124 to 0.3.33.dev1 (0.3.33 is outside it)
- CVE-2024-7035: 0.1.124 to 0.3.15 (0.3.16 is outside it)
- CVE-2024-7041: 0.1.124 to 0.6.2 (0.6.3 is outside it)
- CVE-2024-6706: 0.1.124 to 0.3.13 (0.3.14 is outside it)

## Advisories (149)

### [CVE-2026-88006](https://cve.now/CVE-2026-88006): Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

- Severity: Medium 6.5
- Published: Sep 10, 2026
- Affected: from 0.8.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 16 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-88005](https://cve.now/CVE-2026-88005): Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

- Severity: Medium 6.5
- Published: Sep 10, 2026
- Affected: from 0.8.0, fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 142 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-88002](https://cve.now/CVE-2026-88002): Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

- Severity: Medium 6.5
- Published: Sep 9, 2026
- Affected: from 0.5.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-88001](https://cve.now/CVE-2026-88001): Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

- Severity: Medium 5.0
- Published: Sep 9, 2026
- Affected: from 0.9.5, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-88000](https://cve.now/CVE-2026-88000): Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

- Severity: Medium 6.5
- Published: Sep 9, 2026
- Affected: from 0.10.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87999](https://cve.now/CVE-2026-87999): Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

- Severity: High 7.1
- Published: Sep 9, 2026
- Affected: fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87998](https://cve.now/CVE-2026-87998): Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

- Severity: High 7.1
- Published: Sep 9, 2026
- Affected: from 0.10.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87997](https://cve.now/CVE-2026-87997): Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

- Severity: Medium 4.3
- Published: Sep 9, 2026
- Affected: from 0.10.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87996](https://cve.now/CVE-2026-87996): Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

- Severity: High 7.7
- Published: Sep 9, 2026
- Affected: from 0.9.6, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87995](https://cve.now/CVE-2026-87995): Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

- Severity: High 8.7
- Published: Sep 9, 2026
- Affected: from 0.8.11, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87994](https://cve.now/CVE-2026-87994): Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

- Severity: Medium 4.3
- Published: Sep 9, 2026
- Affected: from 0.9.5, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87017](https://cve.now/CVE-2026-87017): Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

- Severity: Medium 4.3
- Published: Sep 9, 2026
- Affected: from 0.7.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87016](https://cve.now/CVE-2026-87016): Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

- Severity: High 8.1
- Published: Sep 9, 2026
- Affected: from 0.6.41, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87015](https://cve.now/CVE-2026-87015): Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

- Severity: Medium 6.8
- Published: Sep 9, 2026
- Affected: from 0.6.27, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87014](https://cve.now/CVE-2026-87014): Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

- Severity: Medium 6.5
- Published: Sep 9, 2026
- Affected: from 0.9.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87013](https://cve.now/CVE-2026-87013): Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

- Severity: Medium 4.3
- Published: Sep 9, 2026
- Affected: from 0.10.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87012](https://cve.now/CVE-2026-87012): Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

- Severity: Medium 4.3
- Published: Sep 9, 2026
- Affected: from 0.9.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-87011](https://cve.now/CVE-2026-87011): Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

- Severity: High 7.5
- Published: Sep 9, 2026
- Affected: from 0.9.0, fixed in 0.11.1.
- Fixed in 0.11.1 (released Aug 25, 2026, 15 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59714](https://cve.now/CVE-2026-59714): Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message\_ids)

- Severity: High 7.1
- Published: Aug 13, 2026
- Affected: from 0.9.5, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 45 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70494](https://cve.now/CVE-2026-70494): Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

- Severity: High 8.1
- Published: Aug 4, 2026
- Affected: from 0.10.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70493](https://cve.now/CVE-2026-70493): Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

- Severity: Medium 6.5
- Published: Aug 4, 2026
- Affected: from 0.9.6, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70492](https://cve.now/CVE-2026-70492): Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

- Severity: High 8.7
- Published: Aug 4, 2026
- Affected: from 0.10.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70491](https://cve.now/CVE-2026-70491): Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

- Severity: Medium 6.5
- Published: Aug 4, 2026
- Affected: fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70490](https://cve.now/CVE-2026-70490): Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

- Severity: Medium 6.3
- Published: Aug 4, 2026
- Affected: from 0.8.8, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70489](https://cve.now/CVE-2026-70489): Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

- Severity: Medium 6.5
- Published: Aug 4, 2026
- Affected: from 0.9.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54020](https://cve.now/CVE-2026-54020): Open WebUI: DNS Rebinding SSRF Bypass

- Severity: Medium 6.3
- Published: Aug 4, 2026
- Affected: fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70488](https://cve.now/CVE-2026-70488): Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

- Severity: Medium 4.3
- Published: Aug 4, 2026
- Affected: from 0.9.6, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70487](https://cve.now/CVE-2026-70487): Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

- Severity: Medium 5.3
- Published: Aug 4, 2026
- Affected: from 0.8.8, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70486](https://cve.now/CVE-2026-70486): Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

- Severity: High 8.2
- Published: Aug 4, 2026
- Affected: from 0.9.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70485](https://cve.now/CVE-2026-70485): Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

- Severity: High 7.1
- Published: Aug 4, 2026
- Affected: from 0.9.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70484](https://cve.now/CVE-2026-70484): Open WebUI: Users denied the image-generation permission can still generate images via chat completions

- Severity: Medium 4.3
- Published: Aug 4, 2026
- Affected: from 0.7.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70483](https://cve.now/CVE-2026-70483): Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

- Severity: Low 3.1
- Published: Aug 4, 2026
- Affected: from 0.9.6, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70482](https://cve.now/CVE-2026-70482): Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

- Severity: High 8.1
- Published: Aug 4, 2026
- Affected: from 0.8.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70481](https://cve.now/CVE-2026-70481): Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

- Severity: Medium 5.4
- Published: Aug 4, 2026
- Affected: from 0.5.0, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70480](https://cve.now/CVE-2026-70480): Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

- Severity: Medium 4.1
- Published: Aug 4, 2026
- Affected: from 0.6.34, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-70479](https://cve.now/CVE-2026-70479): Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

- Severity: High 7.7
- Published: Aug 4, 2026
- Affected: from 0.9.6, fixed in 0.11.0.
- Fixed in 0.11.0 (released Jul 27, 2026, 8 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-56400](https://cve.now/CVE-2026-56400): open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation

- Severity: Critical 9.0
- Published: Jul 15, 2026
- Affected: fixed in 0.3.33.
- Fixed in 0.3.33 (released Oct 24, 2024, 629 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-56398](https://cve.now/CVE-2026-56398): Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI

- Severity: High 8.5
- Published: Jul 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 66 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59221](https://cve.now/CVE-2026-59221): open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

- Severity: High 7.7
- Published: Jul 9, 2026
- Affected: from 0.9.6, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59225](https://cve.now/CVE-2026-59225): Open WebUI: Arena task endpoints can bypass underlying model access controls

- Severity: Medium 5.4
- Published: Jul 9, 2026
- Affected: from 0.8.12, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59224](https://cve.now/CVE-2026-59224): Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws\_terminal…

- Severity: High 8.0
- Published: Jul 9, 2026
- Affected: fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59212](https://cve.now/CVE-2026-59212): Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

- Severity: Medium 5.4
- Published: Jul 9, 2026
- Affected: from 0.9.6, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59223](https://cve.now/CVE-2026-59223): Open WebUI: \`WEB\_FETCH\_FILTER\_LIST\` host allow/block filter bypassable via URL path and non-label-boundary matching

- Severity: Medium 4.3
- Published: Jul 9, 2026
- Affected: fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59222](https://cve.now/CVE-2026-59222): Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

- Severity: Medium 6.0
- Published: Jul 9, 2026
- Affected: from 0.7.0, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59215](https://cve.now/CVE-2026-59215): Open WebUI: Private channel messages can be disclosed through cross-channel thread parent\_id binding

- Severity: Low 3.1
- Published: Jul 9, 2026
- Affected: fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59213](https://cve.now/CVE-2026-59213): Open WebUI: Cross-user model-list exposure via static cache key in get\_all\_models (aiocache key= vs key\_builder= misuse)

- Severity: Low 3.5
- Published: Jul 9, 2026
- Affected: from 0.6.27, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59217](https://cve.now/CVE-2026-59217): Open WebUI: Upload \`metadata.knowledge\_id\` bypasses the knowledge-base write-access check (read-only users can add files to KB)

- Severity: Medium 4.3
- Published: Jul 9, 2026
- Affected: fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59216](https://cve.now/CVE-2026-59216): Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session\_id

- Severity: High 7.7
- Published: Jul 9, 2026
- Affected: fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59219](https://cve.now/CVE-2026-59219): Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

- Severity: High 7.1
- Published: Jul 9, 2026
- Affected: from 0.9.0, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59715](https://cve.now/CVE-2026-59715): Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

- Severity: Low 3.1
- Published: Jul 9, 2026
- Affected: from 0.6.16, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59220](https://cve.now/CVE-2026-59220): Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

- Severity: Medium 6.5
- Published: Jul 9, 2026
- Affected: from 0.9.2, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59226](https://cve.now/CVE-2026-59226): Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

- Severity: Low 3.1
- Published: Jul 9, 2026
- Affected: from 0.9.0, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59227](https://cve.now/CVE-2026-59227): Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

- Severity: Medium 4.3
- Published: Jul 9, 2026
- Affected: from 0.8.11, fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59218](https://cve.now/CVE-2026-59218): Open WebUI: Account enumeration via observable login timing discrepancy

- Severity: Medium 5.3
- Published: Jul 9, 2026
- Affected: fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-59214](https://cve.now/CVE-2026-59214): Open WebUI: Stored web worker XSS via Pyodide

- Severity: High 7.3
- Published: Jul 9, 2026
- Affected: fixed in 0.10.0.
- Fixed in 0.10.0 (released Jun 29, 2026, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54007](https://cve.now/CVE-2026-54007): Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

- Severity: High 7.1
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54006](https://cve.now/CVE-2026-54006): Open WebUI: Calendar event re-parenting allows writing events into another user's calendar

- Severity: Medium 4.3
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54008](https://cve.now/CVE-2026-54008): Open WebUI: Redirect-Bypass SSRF in OAuth \`\_process\_picture\_url\`

- Severity: High 8.5
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54009](https://cve.now/CVE-2026-54009): Open WebUI: Cross-user file disclosure via /api/chat/completions image\_url field

- Severity: Medium 6.5
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54010](https://cve.now/CVE-2026-54010): Open WebUI: Forged chat-file link allows cross-user file read and deletion

- Severity: High 8.3
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54011](https://cve.now/CVE-2026-54011): Open WebUI: Stored XSS in Mermaid Markdown Preview

- Severity: High 8.7
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54012](https://cve.now/CVE-2026-54012): Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

- Severity: High 7.1
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54013](https://cve.now/CVE-2026-54013): Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI

- Severity: High 7.6
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54014](https://cve.now/CVE-2026-54014): Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui

- Severity: Medium 4.3
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54015](https://cve.now/CVE-2026-54015): Open WebUI: Prompt history IDOR: unbound history\_id allows cross-prompt read and deletion

- Severity: Medium 6.4
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54016](https://cve.now/CVE-2026-54016): Open WebUI: Open WebUI BOLA: \`search\_knowledge\_files\` Allows Unauthorized Knowledge Base File Enumeration

- Severity: Medium 4.3
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54018](https://cve.now/CVE-2026-54018): Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

- Severity: High 7.7
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54019](https://cve.now/CVE-2026-54019): Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

- Severity: Medium 6.5
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54021](https://cve.now/CVE-2026-54021): Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url\_idx path parameter

- Severity: Medium 6.3
- Published: Jun 23, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 22 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54022](https://cve.now/CVE-2026-54022): Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

- Severity: Medium 5.3
- Published: Jun 23, 2026
- Affected: fixed in 0.8.11.
- Fixed in 0.8.11 (released Mar 25, 2026, 90 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-54017](https://cve.now/CVE-2026-54017): Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

- Severity: High 7.7
- Published: Jun 18, 2026
- Affected: fixed in 0.9.6.
- Fixed in 0.9.6 (released Jun 1, 2026, 17 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45338](https://cve.now/CVE-2026-45338): Open WebUI: SSRF via OAuth Profile Picture URL in \_process\_picture\_url (oauth.py)

- Severity: High 7.7
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44549](https://cve.now/CVE-2026-44549): Open WebUI: Stored XSS in excel file preview

- Severity: High 7.3
- Published: May 15, 2026
- Affected: fixed in 0.8.0.
- Fixed in 0.8.0 (released Feb 12, 2026, 92 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45299](https://cve.now/CVE-2026-45299): Open WebUI: Stored Cross-Site Scripting In Profile Picture

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 0.8.0.
- Fixed in 0.8.0 (released Feb 12, 2026, 92 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45667](https://cve.now/CVE-2026-45667): Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 0.8.0.
- Fixed in 0.8.0 (released Feb 12, 2026, 92 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44565](https://cve.now/CVE-2026-44565): Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal

- Severity: High 8.1
- Published: May 15, 2026
- Affected: fixed in 0.6.10.
- Fixed in 0.6.10 (released May 19, 2025, 361 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45314](https://cve.now/CVE-2026-45314): Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook\_id}/profile/image

- Severity: High 7.4
- Published: May 15, 2026
- Affected: fixed in 0.9.3.
- Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45316](https://cve.now/CVE-2026-45316): Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)

- Severity: Low 3.5
- Published: May 15, 2026
- Affected: fixed in 0.9.3.
- Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45317](https://cve.now/CVE-2026-45317): Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation

- Severity: Medium 4.6
- Published: May 15, 2026
- Affected: fixed in 0.9.3.
- Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45318](https://cve.now/CVE-2026-45318): Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 0.9.3.
- Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45315](https://cve.now/CVE-2026-45315): Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

- Severity: High 8.7
- Published: May 15, 2026
- Affected: fixed in 0.9.3.
- Fixed in 0.9.3 (released May 9, 2026, 6 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44571](https://cve.now/CVE-2026-44571): Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 0.8.6.
- Fixed in 0.8.6 (released Mar 1, 2026, 75 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45350](https://cve.now/CVE-2026-45350): Open WebUI: Chat completion API allows tool restrictions to be bypassed

- Severity: High 7.1
- Published: May 15, 2026
- Affected: fixed in 0.8.6.
- Fixed in 0.8.6 (released Mar 1, 2026, 75 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45303](https://cve.now/CVE-2026-45303): Open WebUI: Stored XSS via the HTML renedering view

- Severity: High 7.7
- Published: May 15, 2026
- Affected: fixed in 0.6.5.
- Fixed in 0.6.5 (released Apr 14, 2025, 396 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45301](https://cve.now/CVE-2026-45301): Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

- Severity: High 8.1
- Published: May 15, 2026
- Affected: fixed in 0.3.16.
- Fixed in 0.3.16 (released Aug 27, 2024, 626 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45345](https://cve.now/CVE-2026-45345): Open WebUI: Missing authorization check at the model update function - models from other users can be updated

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 0.5.7.
- Fixed in 0.5.7 (released Jan 23, 2025, 477 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45347](https://cve.now/CVE-2026-45347): Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function

- Severity: Medium 4.3
- Published: May 15, 2026
- Affected: fixed in 0.5.11.
- Fixed in 0.5.11 (released Feb 13, 2025, 456 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45351](https://cve.now/CVE-2026-45351): Open WebUI: Exposure of System Prompt to Regular User \[Non-Admin\]

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 0.8.9.
- Fixed in 0.8.9 (released Mar 8, 2026, 68 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45666](https://cve.now/CVE-2026-45666): Open WebUI: Indirect Object Reference (IDOR) in user notes

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 0.8.11.
- Fixed in 0.8.11 (released Mar 25, 2026, 51 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45365](https://cve.now/CVE-2026-45365): Open WebUI: Authenticated users can bypass model access control via exposed query parameter

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 0.8.11.
- Fixed in 0.8.11 (released Mar 25, 2026, 51 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44570](https://cve.now/CVE-2026-44570): Open WebUI: Inconsistent authorization controls within memories API

- Severity: High 8.3
- Published: May 15, 2026
- Affected: fixed in 0.6.19.
- Fixed in 0.6.19 (released Aug 9, 2025, 279 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44569](https://cve.now/CVE-2026-44569): Open WebUI: Insecure Message Access Breaks Authorization

- Severity: High 7.1
- Published: May 15, 2026
- Affected: fixed in 0.6.19.
- Fixed in 0.6.19 (released Aug 9, 2025, 279 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44566](https://cve.now/CVE-2026-44566): Open WebUI: Arbitrary File Upload and Path Traversal

- Severity: High 7.3
- Published: May 15, 2026
- Affected: fixed in 0.1.124.
- Fixed in 0.1.124 (released May 20, 2024, 725 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44567](https://cve.now/CVE-2026-44567): Open WebUI: Open WebUI Improper Authorization Control

- Severity: High 7.3
- Published: May 15, 2026
- Affected: fixed in 0.1.124.
- Fixed in 0.1.124 (released May 20, 2024, 725 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45672](https://cve.now/CVE-2026-45672): Open WebUI: Jupyter code execution works despite \`ENABLE\_CODE\_EXECUTION=false\` — feature gate bypassed

- Severity: High 8.8
- Published: May 15, 2026
- Affected: fixed in 0.8.12.
- Fixed in 0.8.12 (released Mar 27, 2026, 49 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45400](https://cve.now/CVE-2026-45400): Open WebUI: Server-Side Request Forgery (SSRF) bypass in \`validate\_url\`

- Severity: High 8.5
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45402](https://cve.now/CVE-2026-45402): Open WebUI: Cross-User File Access via Unchecked file\_id in Folder Knowledge and Knowledge-Base Attach Endpoints

- Severity: High 8.1
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45401](https://cve.now/CVE-2026-45401): Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints

- Severity: High 8.5
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45386](https://cve.now/CVE-2026-45386): Open WebUI: An IDOR vulnerability exists in the pin\_channel\_message API endpoint

- Severity: Medium 4.3
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45398](https://cve.now/CVE-2026-45398): Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls

- Severity: High 7.5
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45397](https://cve.now/CVE-2026-45397): Open WebUI: Unauthenticated RAG Configuration Disclosure

- Severity: Medium 5.3
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45396](https://cve.now/CVE-2026-45396): Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45387](https://cve.now/CVE-2026-45387): Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

- Severity: Medium 4.3
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45385](https://cve.now/CVE-2026-45385): Open WebUI: An IDOR vulnerability exists in the update\_message\_by\_id API endpoint

- Severity: Medium 4.3
- Published: May 15, 2026
- Affected: fixed in 0.9.5.
- Fixed in 0.9.5 (released May 10, 2026, 5 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44721](https://cve.now/CVE-2026-44721): Open WebUI: Stored XSS via Model Description

- Severity: High 7.3
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44550](https://cve.now/CVE-2026-44550): Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

- Severity: Medium 5.0
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44551](https://cve.now/CVE-2026-44551): Open WebUI: LDAP Empty Password Authentication Bypass

- Severity: Critical 9.1
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44552](https://cve.now/CVE-2026-44552): Open WebUI: Redis Cache Keys tool\_servers and terminal\_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning

- Severity: High 8.7
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44553](https://cve.now/CVE-2026-44553): Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

- Severity: High 8.1
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44554](https://cve.now/CVE-2026-44554): Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

- Severity: High 8.1
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44555](https://cve.now/CVE-2026-44555): Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining

- Severity: High 7.6
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44556](https://cve.now/CVE-2026-44556): Open WebUI: responses passthrough endpoint lacks access control authorization

- Severity: High 7.1
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44557](https://cve.now/CVE-2026-44557): Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

- Severity: Medium 4.3
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44558](https://cve.now/CVE-2026-44558): Open WebUI: Channel Access Grants Bypass filter\_allowed\_access\_grants

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44559](https://cve.now/CVE-2026-44559): Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels

- Severity: Medium 4.3
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44560](https://cve.now/CVE-2026-44560): Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44561](https://cve.now/CVE-2026-44561): Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44562](https://cve.now/CVE-2026-44562): Open WebUI: Model Import Overwrites Any Model Without Ownership Check

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44563](https://cve.now/CVE-2026-44563): Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44564](https://cve.now/CVE-2026-44564): Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-44568](https://cve.now/CVE-2026-44568): Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

- Severity: Medium 4.8
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45331](https://cve.now/CVE-2026-45331): Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature

- Severity: High 8.5
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45339](https://cve.now/CVE-2026-45339): Open WebUI: API key endpoint restrictions bypassed via \`x-api-key\` header — full message processing on restricted endpoints

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45349](https://cve.now/CVE-2026-45349): Open WebUI: Broken Access Control for Completions API

- Severity: High 7.1
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45399](https://cve.now/CVE-2026-45399): Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption

- Severity: High 7.1
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45671](https://cve.now/CVE-2026-45671): Open WebUI: shared-chat branch ignores access\_type, allowing unauthorized file deletion

- Severity: High 8.0
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-45675](https://cve.now/CVE-2026-45675): Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

- Severity: High 8.1
- Published: May 15, 2026
- Affected: fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 24 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-34225](https://cve.now/CVE-2026-34225): Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

- Severity: Medium 4.3
- Published: Apr 14, 2026
- Affected: through 0.7.2.
- Fixed in 0.8.0 (released Feb 12, 2026, 61 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-34222](https://cve.now/CVE-2026-34222): Open WebUI has Broken Access Control in Tool Valves

- Severity: High 7.7
- Published: Apr 1, 2026
- Affected: fixed in 0.8.11.
- Fixed in 0.8.11 (released Mar 25, 2026, 7 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-29071](https://cve.now/CVE-2026-29071): Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

- Severity: Low 3.1
- Published: Mar 26, 2026
- Affected: fixed in 0.8.6.
- Fixed in 0.8.6 (released Mar 1, 2026, 25 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-29070](https://cve.now/CVE-2026-29070): Open WebUI has unauthorized deletion of knowledge files

- Severity: Medium 5.4
- Published: Mar 26, 2026
- Affected: fixed in 0.8.6.
- Fixed in 0.8.6 (released Mar 1, 2026, 25 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-28788](https://cve.now/CVE-2026-28788): Open WebUI's process\_files\_batch() endpoint missing ownership check, allows unauthorized file overwrite

- Severity: High 7.1
- Published: Mar 26, 2026
- Affected: fixed in 0.8.6.
- Fixed in 0.8.6 (released Mar 1, 2026, 25 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-28786](https://cve.now/CVE-2026-28786): Open WebUI vulnerable to Path Traversal in \`POST /api/v1/audio/transcriptions\`

- Severity: Medium 4.3
- Published: Mar 26, 2026
- Affected: fixed in 0.8.6.
- Fixed in 0.8.6 (released Mar 1, 2026, 25 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-26193](https://cve.now/CVE-2026-26193): Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

- Severity: High 7.3
- Published: Feb 19, 2026
- Affected: fixed in 0.6.44.
- Fixed in 0.7.0 (released Jan 9, 2026, 41 days before disclosure, the advisory names 0.6.44, which was never published).
- The latest release, 0.13.0, is not affected.

### [CVE-2026-26192](https://cve.now/CVE-2026-26192): Open WebUI vulnerable to Stored XSS via iFrame in citations model

- Severity: High 7.3
- Published: Feb 19, 2026
- Affected: fixed in 0.7.0.
- Fixed in 0.7.0 (released Jan 9, 2026, 41 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2025-65958](https://cve.now/CVE-2025-65958): Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

- Severity: High 8.5
- Published: Dec 4, 2025
- Affected: fixed in 0.6.37.
- Fixed in 0.6.37 (released Nov 24, 2025, 10 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2025-63681](https://cve.now/CVE-2025-63681): open-webui v0.6.33 is vulnerable to Incorrect Access Control.

- Severity: Medium 4.3
- Published: Dec 4, 2025
- Affected: through 0.6.33; fixed in 0.9.0.
- Fixed in 0.9.0 (released Apr 21, 2026, 138 days after disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2025-64496](https://cve.now/CVE-2025-64496): Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

- Severity: High 7.3
- Published: Nov 8, 2025
- Affected: fixed in 0.6.35.
- Fixed in 0.6.35 (released Nov 6, 2025, 2 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2025-64495](https://cve.now/CVE-2025-64495): Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

- Severity: High 8.7
- Published: Nov 8, 2025
- Affected: fixed in 0.6.35.
- Fixed in 0.6.35 (released Nov 6, 2025, 2 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2025-46719](https://cve.now/CVE-2025-46719): Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via…

- Severity: Medium 5.4
- Published: May 5, 2025
- Affected: fixed in 0.6.6.
- Fixed in 0.6.6 (released May 5, 2025, the day of disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2025-46571](https://cve.now/CVE-2025-46571): Open WebUI vulnerable to limited stored XSS vila uploaded html file

- Severity: Medium 5.3
- Published: May 5, 2025
- Affected: fixed in 0.6.6.
- Fixed in 0.6.6 (released May 5, 2025, the day of disclosure).
- The latest release, 0.13.0, is not affected.

### [GHSA-W466-2WFC-8G58](https://cve.now/GHSA-W466-2WFC-8G58): Open WebUI has vulnerable dependency on starlette via fastapi

- Severity: High
- Published: Mar 20, 2025
- Affected: fixed in 0.5.8.
- Fixed in 0.5.8 (released Feb 5, 2025, 43 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2024-8053](https://cve.now/CVE-2024-8053): Improper Authentication in open-webui/open-webui

- Severity: High 7.5
- Published: Mar 20, 2025
- Affected: through 0.3.10; fixed in 0.5.13.
- Fixed in 0.5.13 (released Feb 18, 2025, 30 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2024-7043](https://cve.now/CVE-2024-7043): Improper Access Control in open-webui/open-webui

- Severity: High 8.1
- Published: Mar 20, 2025
- Affected: through 0.3.8; fixed in 0.3.16.
- Fixed in 0.3.16 (released Aug 27, 2024, 205 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2024-7983](https://cve.now/CVE-2024-7983): Denial of Service in open-webui/open-webui

- Severity: High 7.5
- Published: Mar 20, 2025
- Affected: through 0.3.8; fixed in 0.5.13.
- Fixed in 0.5.13 (released Feb 18, 2025, 30 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2024-7044](https://cve.now/CVE-2024-7044): Stored XSS in open-webui/open-webui

- Severity: Medium 6.8
- Published: Mar 20, 2025
- Affected: through 0.3.8; fixed in 0.3.33.
- Fixed in 0.3.33 (released Oct 24, 2024, 147 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2024-7035](https://cve.now/CVE-2024-7035): Cross-Site Request Forgery (CSRF) in open-webui/open-webui

- Severity: Medium 6.9
- Published: Mar 20, 2025
- Affected: through 0.3.8; fixed in 0.3.16.
- Fixed in 0.3.16 (released Aug 27, 2024, 205 days before disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2024-7041](https://cve.now/CVE-2024-7041): IDOR in open-webui/open-webui

- Severity: Medium 6.5
- Published: Oct 9, 2024
- Affected: fixed in 0.6.3.
- Fixed in 0.6.3 (released Apr 13, 2025, 186 days after disclosure).
- The latest release, 0.13.0, is not affected.

### [CVE-2024-6706](https://cve.now/CVE-2024-6706): Open WebUI Stored Cross-Site Scripting

- Severity: Medium 6.3
- Published: Aug 7, 2024
- Affected: fixed in 0.3.14.
- Fixed in 0.3.14 (released Aug 21, 2024, 14 days after disclosure).
- The latest release, 0.13.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/open-webui
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.