Open-webui vulnerabilities
175 CVEs and advisories name Open-webui as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-59212Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
- CVE-2026-59223Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
- CVE-2026-59222Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
- CVE-2026-59215Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding
- CVE-2026-59213Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
- CVE-2026-59217Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
- CVE-2026-59216Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
- CVE-2026-59219Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
- CVE-2026-59715Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
- CVE-2026-59220Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
- CVE-2026-59226Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation
- CVE-2026-59227Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
- CVE-2026-59218Open WebUI: Account enumeration via observable login timing discrepancy
- CVE-2026-59214Open WebUI: Stored web worker XSS via Pyodide
- CVE-2026-56399Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web
- CVE-2026-54007Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
- CVE-2026-54006Open WebUI: Calendar event re-parenting allows writing events into another user's calendar
- CVE-2026-54008Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`
- CVE-2026-54009Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
- CVE-2026-54010Open WebUI: Forged chat-file link allows cross-user file read and deletion
- CVE-2026-54011Open WebUI: Stored XSS in Mermaid Markdown Preview
- CVE-2026-54012Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
- CVE-2026-54013Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI
- CVE-2026-54014Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui
- CVE-2026-54015Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
- CVE-2026-54016Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
- CVE-2026-54018Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
- CVE-2026-54019Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
- CVE-2026-54021Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter
- CVE-2026-54022Open WebUI: Any authenticated user can read other users' private notes via Socket.IO