# cve.now: Open-webui

The newest entries naming Open-webui as an affected vendor (up to 200), of 175 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109572](https://cve.now/CVE-2026-109572.md): Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy (CVSS 7.2)
- [CVE-2026-109300](https://cve.now/CVE-2026-109300.md): Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds (CVSS 5.1)
- [CVE-2026-109299](https://cve.now/CVE-2026-109299.md): Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation (CVSS 7.1)
- [CVE-2026-109298](https://cve.now/CVE-2026-109298.md): Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex (CVSS 7.1)
- [CVE-2026-109297](https://cve.now/CVE-2026-109297.md): Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules (CVSS 7.1)
- [CVE-2026-109296](https://cve.now/CVE-2026-109296.md): Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes (CVSS 5.3)
- [CVE-2026-109295](https://cve.now/CVE-2026-109295.md): Open WebUI 0.11.0 before 0.11.4 ReDoS via grep\_knowledge\_files Event Loop (CVSS 5.3)
- [CVE-2026-109294](https://cve.now/CVE-2026-109294.md): Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image (CVSS 7.1)
- [CVE-2026-109293](https://cve.now/CVE-2026-109293.md): Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint (CVSS 7.1)
- [CVE-2026-109292](https://cve.now/CVE-2026-109292.md): Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections (CVSS 7.6)
- [CVE-2026-109291](https://cve.now/CVE-2026-109291.md): Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed\_url (CVSS 8.5)
- [CVE-2026-109290](https://cve.now/CVE-2026-109290.md): Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview (CVSS 8.4)
- [CVE-2026-109289](https://cve.now/CVE-2026-109289.md): Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket (CVSS 5.3)
- [CVE-2026-109288](https://cve.now/CVE-2026-109288.md): Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links (CVSS 7.2)
- [CVE-2026-109287](https://cve.now/CVE-2026-109287.md): Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID (CVSS 5.3)
- [CVE-2026-109286](https://cve.now/CVE-2026-109286.md): Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal (CVSS 8.6)
- [CVE-2026-109285](https://cve.now/CVE-2026-109285.md): Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata (CVSS 2.3)
- [CVE-2026-109284](https://cve.now/CVE-2026-109284.md): Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint (CVSS 5.3)
- [CVE-2026-109283](https://cve.now/CVE-2026-109283.md): Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange (CVSS 5.3)
- [CVE-2026-88006](https://cve.now/CVE-2026-88006.md): Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange (CVSS 6.5)
- [CVE-2026-88005](https://cve.now/CVE-2026-88005.md): Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange (CVSS 6.5)
- [CVE-2026-88002](https://cve.now/CVE-2026-88002.md): Open WebUI: Any authenticated user can hang the server via a cyclic chat message history (CVSS 6.5)
- [CVE-2026-88001](https://cve.now/CVE-2026-88001.md): Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets (CVSS 5.0)
- [CVE-2026-88000](https://cve.now/CVE-2026-88000.md): Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree (CVSS 6.5)
- [CVE-2026-87999](https://cve.now/CVE-2026-87999.md): Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch (CVSS 7.1)
- [CVE-2026-87998](https://cve.now/CVE-2026-87998.md): Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion (CVSS 7.1)
- [CVE-2026-87997](https://cve.now/CVE-2026-87997.md): Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions (CVSS 4.3)
- [CVE-2026-87996](https://cve.now/CVE-2026-87996.md): Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader (CVSS 7.7)
- [CVE-2026-87995](https://cve.now/CVE-2026-87995.md): Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin (CVSS 8.7)
- [CVE-2026-87994](https://cve.now/CVE-2026-87994.md): Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint (CVSS 4.3)
- [CVE-2026-87017](https://cve.now/CVE-2026-87017.md): Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends (CVSS 4.3)
- [CVE-2026-87016](https://cve.now/CVE-2026-87016.md): Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite (CVSS 8.1)
- [CVE-2026-87015](https://cve.now/CVE-2026-87015.md): Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication (CVSS 6.8)
- [CVE-2026-87014](https://cve.now/CVE-2026-87014.md): Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes (CVSS 6.5)
- [CVE-2026-87013](https://cve.now/CVE-2026-87013.md): Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle (CVSS 4.3)
- [CVE-2026-87012](https://cve.now/CVE-2026-87012.md): Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value (CVSS 4.3)
- [CVE-2026-87011](https://cve.now/CVE-2026-87011.md): Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout (CVSS 7.5)
- [CVE-2026-59714](https://cve.now/CVE-2026-59714.md): Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message\_ids) (CVSS 7.1)
- [CVE-2026-70494](https://cve.now/CVE-2026-70494.md): Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder (CVSS 8.1)
- [CVE-2026-70493](https://cve.now/CVE-2026-70493.md): Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically (CVSS 6.5)
- [CVE-2026-70492](https://cve.now/CVE-2026-70492.md): Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages (CVSS 8.7)
- [CVE-2026-70491](https://cve.now/CVE-2026-70491.md): Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints (CVSS 6.5)
- [CVE-2026-70490](https://cve.now/CVE-2026-70490.md): Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check (CVSS 6.3)
- [CVE-2026-70489](https://cve.now/CVE-2026-70489.md): Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing (CVSS 6.5)
- [CVE-2026-54020](https://cve.now/CVE-2026-54020.md): Open WebUI: DNS Rebinding SSRF Bypass (CVSS 6.3)
- [CVE-2026-70488](https://cve.now/CVE-2026-70488.md): Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup (CVSS 4.3)
- [CVE-2026-70487](https://cve.now/CVE-2026-70487.md): Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata (CVSS 5.3)
- [CVE-2026-70486](https://cve.now/CVE-2026-70486.md): Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin (CVSS 8.2)
- [CVE-2026-70485](https://cve.now/CVE-2026-70485.md): Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs (CVSS 7.1)
- [CVE-2026-70484](https://cve.now/CVE-2026-70484.md): Open WebUI: Users denied the image-generation permission can still generate images via chat completions (CVSS 4.3)
- [CVE-2026-70483](https://cve.now/CVE-2026-70483.md): Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint (CVSS 3.1)
- [CVE-2026-70482](https://cve.now/CVE-2026-70482.md): Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client (CVSS 8.1)
- [CVE-2026-70481](https://cve.now/CVE-2026-70481.md): Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages (CVSS 5.4)
- [CVE-2026-70480](https://cve.now/CVE-2026-70480.md): Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering (CVSS 4.1)
- [CVE-2026-70479](https://cve.now/CVE-2026-70479.md): Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader (CVSS 7.7)
- [CVE-2026-56400](https://cve.now/CVE-2026-56400.md): open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation (CVSS 9.0)
- [CVE-2026-56398](https://cve.now/CVE-2026-56398.md): Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI (CVSS 8.5)
- [CVE-2026-59221](https://cve.now/CVE-2026-59221.md): open-webui terminal proxy path traversal guard bypass via 9x encoded traversal (CVSS 7.7)
- [CVE-2026-59225](https://cve.now/CVE-2026-59225.md): Open WebUI: Arena task endpoints can bypass underlying model access controls (CVSS 5.4)
- [CVE-2026-59224](https://cve.now/CVE-2026-59224.md): Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws\_terminal session\_id query injection) (CVSS 8.0)
- [CVE-2026-59212](https://cve.now/CVE-2026-59212.md): Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete (CVSS 5.4)
- [CVE-2026-59223](https://cve.now/CVE-2026-59223.md): Open WebUI: \`WEB\_FETCH\_FILTER\_LIST\` host allow/block filter bypassable via URL path and non-label-boundary matching (CVSS 4.3)
- [CVE-2026-59222](https://cve.now/CVE-2026-59222.md): Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials (CVSS 6.0)
- [CVE-2026-59215](https://cve.now/CVE-2026-59215.md): Open WebUI: Private channel messages can be disclosed through cross-channel thread parent\_id binding (CVSS 3.1)
- [CVE-2026-59213](https://cve.now/CVE-2026-59213.md): Open WebUI: Cross-user model-list exposure via static cache key in get\_all\_models (aiocache key= vs key\_builder= misuse) (CVSS 3.5)
- [CVE-2026-59217](https://cve.now/CVE-2026-59217.md): Open WebUI: Upload \`metadata.knowledge\_id\` bypasses the knowledge-base write-access check (read-only users can add files to KB) (CVSS 4.3)
- [CVE-2026-59216](https://cve.now/CVE-2026-59216.md): Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session\_id (CVSS 7.7)
- [CVE-2026-59219](https://cve.now/CVE-2026-59219.md): Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout (CVSS 7.1)
- [CVE-2026-59715](https://cve.now/CVE-2026-59715.md): Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave) (CVSS 3.1)
- [CVE-2026-59220](https://cve.now/CVE-2026-59220.md): Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config (CVSS 6.5)
- [CVE-2026-59226](https://cve.now/CVE-2026-59226.md): Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation (CVSS 3.1)
- [CVE-2026-59227](https://cve.now/CVE-2026-59227.md): Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission (CVSS 4.3)
- [CVE-2026-59218](https://cve.now/CVE-2026-59218.md): Open WebUI: Account enumeration via observable login timing discrepancy (CVSS 5.3)
- [CVE-2026-59214](https://cve.now/CVE-2026-59214.md): Open WebUI: Stored web worker XSS via Pyodide (CVSS 7.3)
- [CVE-2026-56399](https://cve.now/CVE-2026-56399.md): Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web (CVSS 5.3)
- [CVE-2026-54007](https://cve.now/CVE-2026-54007.md): Open WebUI: Cross-origin postMessage confirmation bypass via action:submit (CVSS 7.1)
- [CVE-2026-54006](https://cve.now/CVE-2026-54006.md): Open WebUI: Calendar event re-parenting allows writing events into another user's calendar (CVSS 4.3)
- [CVE-2026-54008](https://cve.now/CVE-2026-54008.md): Open WebUI: Redirect-Bypass SSRF in OAuth \`\_process\_picture\_url\` (CVSS 8.5)
- [CVE-2026-54009](https://cve.now/CVE-2026-54009.md): Open WebUI: Cross-user file disclosure via /api/chat/completions image\_url field (CVSS 6.5)
- [CVE-2026-54010](https://cve.now/CVE-2026-54010.md): Open WebUI: Forged chat-file link allows cross-user file read and deletion (CVSS 8.3)
- [CVE-2026-54011](https://cve.now/CVE-2026-54011.md): Open WebUI: Stored XSS in Mermaid Markdown Preview (CVSS 8.7)
- [CVE-2026-54012](https://cve.now/CVE-2026-54012.md): Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion (CVSS 7.1)
- [CVE-2026-54013](https://cve.now/CVE-2026-54013.md): Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI (CVSS 7.6)
- [CVE-2026-54014](https://cve.now/CVE-2026-54014.md): Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui (CVSS 4.3)
- [CVE-2026-54015](https://cve.now/CVE-2026-54015.md): Open WebUI: Prompt history IDOR: unbound history\_id allows cross-prompt read and deletion (CVSS 6.4)
- [CVE-2026-54016](https://cve.now/CVE-2026-54016.md): Open WebUI: Open WebUI BOLA: \`search\_knowledge\_files\` Allows Unauthorized Knowledge Base File Enumeration (CVSS 4.3)
- [CVE-2026-54018](https://cve.now/CVE-2026-54018.md): Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects (CVSS 7.7)
- [CVE-2026-54019](https://cve.now/CVE-2026-54019.md): Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode (CVSS 6.5)
- [CVE-2026-54021](https://cve.now/CVE-2026-54021.md): Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url\_idx path parameter (CVSS 6.3)
- [CVE-2026-54022](https://cve.now/CVE-2026-54022.md): Open WebUI: Any authenticated user can read other users' private notes via Socket.IO (CVSS 5.3)
- [CVE-2026-54017](https://cve.now/CVE-2026-54017.md): Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal (CVSS 7.7)
- [CVE-2026-45338](https://cve.now/CVE-2026-45338.md): Open WebUI: SSRF via OAuth Profile Picture URL in \_process\_picture\_url (oauth.py) (CVSS 7.7)
- [CVE-2026-44549](https://cve.now/CVE-2026-44549.md): Open WebUI: Stored XSS in excel file preview (CVSS 7.3)
- [CVE-2026-45299](https://cve.now/CVE-2026-45299.md): Open WebUI: Stored Cross-Site Scripting In Profile Picture (CVSS 5.4)
- [CVE-2026-45665](https://cve.now/CVE-2026-45665.md): Open WebUI: Stored XSS in Banner Component via Improper Sanitization Order (CVSS 8.1)
- [CVE-2026-45667](https://cve.now/CVE-2026-45667.md): Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS) (CVSS 6.5)
- [CVE-2026-44565](https://cve.now/CVE-2026-44565.md): Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal (CVSS 8.1)
- [CVE-2026-45314](https://cve.now/CVE-2026-45314.md): Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook\_id}/profile/image (CVSS 7.4)
- [CVE-2026-45316](https://cve.now/CVE-2026-45316.md): Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access) (CVSS 3.5)
- [CVE-2026-45317](https://cve.now/CVE-2026-45317.md): Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation (CVSS 4.6)
- [CVE-2026-45318](https://cve.now/CVE-2026-45318.md): Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify) (CVSS 5.4)
- [CVE-2026-45315](https://cve.now/CVE-2026-45315.md): Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions (CVSS 8.7)
- [CVE-2026-44571](https://cve.now/CVE-2026-44571.md): Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission (CVSS 6.5)
- [CVE-2026-45350](https://cve.now/CVE-2026-45350.md): Open WebUI: Chat completion API allows tool restrictions to be bypassed (CVSS 7.1)
- [CVE-2026-45303](https://cve.now/CVE-2026-45303.md): Open WebUI: Stored XSS via the HTML renedering view (CVSS 7.7)
- [CVE-2026-45301](https://cve.now/CVE-2026-45301.md): Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file (CVSS 8.1)
- [CVE-2026-45345](https://cve.now/CVE-2026-45345.md): Open WebUI: Missing authorization check at the model update function - models from other users can be updated (CVSS 6.5)
- [CVE-2026-45346](https://cve.now/CVE-2026-45346.md): Open WebUI: Stored Cross-Site Scripting in SVG Renderer (CVSS 5.1)
- [CVE-2026-45347](https://cve.now/CVE-2026-45347.md): Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function (CVSS 4.3)
- [CVE-2026-45351](https://cve.now/CVE-2026-45351.md): Open WebUI: Exposure of System Prompt to Regular User \[Non-Admin\] (CVSS 6.5)
- [CVE-2026-45666](https://cve.now/CVE-2026-45666.md): Open WebUI: Indirect Object Reference (IDOR) in user notes (CVSS 6.5)
- [CVE-2026-45365](https://cve.now/CVE-2026-45365.md): Open WebUI: Authenticated users can bypass model access control via exposed query parameter (CVSS 5.4)
- [CVE-2026-44570](https://cve.now/CVE-2026-44570.md): Open WebUI: Inconsistent authorization controls within memories API (CVSS 8.3)
- [CVE-2026-44569](https://cve.now/CVE-2026-44569.md): Open WebUI: Insecure Message Access Breaks Authorization (CVSS 7.1)
- [CVE-2026-44566](https://cve.now/CVE-2026-44566.md): Open WebUI: Arbitrary File Upload and Path Traversal (CVSS 7.3)
- [CVE-2026-44567](https://cve.now/CVE-2026-44567.md): Open WebUI: Open WebUI Improper Authorization Control (CVSS 7.3)
- [CVE-2026-45672](https://cve.now/CVE-2026-45672.md): Open WebUI: Jupyter code execution works despite \`ENABLE\_CODE\_EXECUTION=false\` — feature gate bypassed (CVSS 8.8)
- [CVE-2026-45400](https://cve.now/CVE-2026-45400.md): Open WebUI: Server-Side Request Forgery (SSRF) bypass in \`validate\_url\` (CVSS 8.5)
- [CVE-2026-45402](https://cve.now/CVE-2026-45402.md): Open WebUI: Cross-User File Access via Unchecked file\_id in Folder Knowledge and Knowledge-Base Attach Endpoints (CVSS 8.1)
- [CVE-2026-45401](https://cve.now/CVE-2026-45401.md): Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (CVSS 8.5)
- [CVE-2026-45386](https://cve.now/CVE-2026-45386.md): Open WebUI: An IDOR vulnerability exists in the pin\_channel\_message API endpoint (CVSS 4.3)
- [CVE-2026-45398](https://cve.now/CVE-2026-45398.md): Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls (CVSS 7.5)
- [CVE-2026-45397](https://cve.now/CVE-2026-45397.md): Open WebUI: Unauthenticated RAG Configuration Disclosure (CVSS 5.3)
- [CVE-2026-45396](https://cve.now/CVE-2026-45396.md): Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation (CVSS 5.4)
- [CVE-2026-45395](https://cve.now/CVE-2026-45395.md): Open WebUI: Missing \`workspace.tools\` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution (CVSS 7.2)
- [CVE-2026-45387](https://cve.now/CVE-2026-45387.md): Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage) (CVSS 4.3)
- [CVE-2026-45385](https://cve.now/CVE-2026-45385.md): Open WebUI: An IDOR vulnerability exists in the update\_message\_by\_id API endpoint (CVSS 4.3)
- [CVE-2026-44721](https://cve.now/CVE-2026-44721.md): Open WebUI: Stored XSS via Model Description (CVSS 7.3)
- [CVE-2026-44550](https://cve.now/CVE-2026-44550.md): Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts (CVSS 5.0)
- [CVE-2026-44551](https://cve.now/CVE-2026-44551.md): Open WebUI: LDAP Empty Password Authentication Bypass (CVSS 9.1)
- [CVE-2026-44552](https://cve.now/CVE-2026-44552.md): Open WebUI: Redis Cache Keys tool\_servers and terminal\_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning (CVSS 8.7)
- [CVE-2026-44553](https://cve.now/CVE-2026-44553.md): Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access (CVSS 8.1)
- [CVE-2026-44554](https://cve.now/CVE-2026-44554.md): Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite (CVSS 8.1)
- [CVE-2026-44555](https://cve.now/CVE-2026-44555.md): Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining (CVSS 7.6)
- [CVE-2026-44556](https://cve.now/CVE-2026-44556.md): Open WebUI: responses passthrough endpoint lacks access control authorization (CVSS 7.1)
- [CVE-2026-44557](https://cve.now/CVE-2026-44557.md): Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection (CVSS 4.3)
- [CVE-2026-44558](https://cve.now/CVE-2026-44558.md): Open WebUI: Channel Access Grants Bypass filter\_allowed\_access\_grants (CVSS 5.4)
- [CVE-2026-44559](https://cve.now/CVE-2026-44559.md): Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels (CVSS 4.3)
- [CVE-2026-44560](https://cve.now/CVE-2026-44560.md): Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search (CVSS 6.5)
- [CVE-2026-44561](https://cve.now/CVE-2026-44561.md): Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels (CVSS 5.4)
- [CVE-2026-44562](https://cve.now/CVE-2026-44562.md): Open WebUI: Model Import Overwrites Any Model Without Ownership Check (CVSS 6.5)
- [CVE-2026-44563](https://cve.now/CVE-2026-44563.md): Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show (CVSS 5.4)
- [CVE-2026-44564](https://cve.now/CVE-2026-44564.md): Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO (CVSS 5.4)
- [CVE-2026-44568](https://cve.now/CVE-2026-44568.md): Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order (CVSS 4.8)
- [CVE-2026-45331](https://cve.now/CVE-2026-45331.md): Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature (CVSS 8.5)
- [CVE-2026-45339](https://cve.now/CVE-2026-45339.md): Open WebUI: API key endpoint restrictions bypassed via \`x-api-key\` header — full message processing on restricted endpoints (CVSS 6.5)
- [CVE-2026-45349](https://cve.now/CVE-2026-45349.md): Open WebUI: Broken Access Control for Completions API (CVSS 7.1)
- [CVE-2026-45399](https://cve.now/CVE-2026-45399.md): Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption (CVSS 7.1)
- [CVE-2026-45671](https://cve.now/CVE-2026-45671.md): Open WebUI: shared-chat branch ignores access\_type, allowing unauthorized file deletion (CVSS 8.0)
- [CVE-2026-45675](https://cve.now/CVE-2026-45675.md): Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts (CVSS 8.1)
- [CVE-2026-34225](https://cve.now/CVE-2026-34225.md): Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality (CVSS 4.3)
- [CVE-2026-34222](https://cve.now/CVE-2026-34222.md): Open WebUI has Broken Access Control in Tool Valves (CVSS 7.7)
- [CVE-2026-29071](https://cve.now/CVE-2026-29071.md): Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories (CVSS 3.1)
- [CVE-2026-29070](https://cve.now/CVE-2026-29070.md): Open WebUI has unauthorized deletion of knowledge files (CVSS 5.4)
- [CVE-2026-28788](https://cve.now/CVE-2026-28788.md): Open WebUI's process\_files\_batch() endpoint missing ownership check, allows unauthorized file overwrite (CVSS 7.1)
- [CVE-2026-28786](https://cve.now/CVE-2026-28786.md): Open WebUI vulnerable to Path Traversal in \`POST /api/v1/audio/transcriptions\` (CVSS 4.3)
- [CVE-2026-26193](https://cve.now/CVE-2026-26193.md): Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages (CVSS 7.3)
- [CVE-2026-26192](https://cve.now/CVE-2026-26192.md): Open WebUI vulnerable to Stored XSS via iFrame in citations model (CVSS 7.3)
- [CVE-2025-65959](https://cve.now/CVE-2025-65959.md): Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF' (CVSS 8.7)
- [CVE-2025-65958](https://cve.now/CVE-2025-65958.md): Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web (CVSS 8.5)
- [CVE-2025-64496](https://cve.now/CVE-2025-64496.md): Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events (CVSS 7.3)
- [CVE-2025-64495](https://cve.now/CVE-2025-64495.md): Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE (CVSS 8.7)
- [CVE-2025-46719](https://cve.now/CVE-2025-46719.md): Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions (CVSS 5.4)
- [CVE-2025-46571](https://cve.now/CVE-2025-46571.md): Open WebUI vulnerable to limited stored XSS vila uploaded html file (CVSS 5.3)
- [CVE-2024-8017](https://cve.now/CVE-2024-8017.md): Cross-site Scripting (XSS) in open-webui/open-webui (CVSS 9.0)
- [CVE-2024-8053](https://cve.now/CVE-2024-8053.md): Improper Authentication in open-webui/open-webui (CVSS 7.5)
- [CVE-2024-7043](https://cve.now/CVE-2024-7043.md): Improper Access Control in open-webui/open-webui (CVSS 8.1)
- [CVE-2024-7983](https://cve.now/CVE-2024-7983.md): Denial of Service in open-webui/open-webui (CVSS 7.5)
- [CVE-2024-7044](https://cve.now/CVE-2024-7044.md): Stored XSS in open-webui/open-webui (CVSS 6.8)
- [CVE-2024-7035](https://cve.now/CVE-2024-7035.md): Cross-Site Request Forgery (CSRF) in open-webui/open-webui (CVSS 6.9)
- [CVE-2024-7048](https://cve.now/CVE-2024-7048.md): IDOR in open-webui/open-webui (CVSS 6.3)
- [CVE-2024-7041](https://cve.now/CVE-2024-7041.md): IDOR in open-webui/open-webui (CVSS 6.5)
- [CVE-2024-6707](https://cve.now/CVE-2024-6707.md): Open WebUI Arbitrary File Upload + Path Traversal (CVSS 7.5)
- [CVE-2024-6706](https://cve.now/CVE-2024-6706.md): Open WebUI Stored Cross-Site Scripting (CVSS 6.3)
- [CVE-2024-30256](https://cve.now/CVE-2024-30256.md): Open WebUI vulnerable to server-side request forgery in utils.py (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/open-webui
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.