Open WebUI vulnerabilities and CVEs

CVE-2026-87011

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

CVE-2026-87012

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

CVE-2026-87013

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

CVE-2026-87014

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

CVE-2026-87015

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

CVE-2026-87016

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

CVE-2026-87017

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

CVE-2026-87994

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

CVE-2026-87995

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

CVE-2026-87996

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

CVE-2026-87997

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

CVE-2026-87998

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

CVE-2026-87999

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

CVE-2026-88005

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

CVE-2026-88006

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

CVE-2026-88000

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

CVE-2026-88001

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

CVE-2026-88002

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

CVE-2026-54020

Open WebUI: DNS Rebinding SSRF Bypass

CVE-2026-70479

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

CVE-2026-70480

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

CVE-2026-70481

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

CVE-2026-70482

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

CVE-2026-70483

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

CVE-2026-70484

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

CVE-2026-70485

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

CVE-2026-70486

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

CVE-2026-70487

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

CVE-2026-70488

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

CVE-2026-70489

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

CVE-2026-70490

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

CVE-2026-70491

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

CVE-2026-70492

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

CVE-2026-70493

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

CVE-2026-70494

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

CVE-2026-59212

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

CVE-2026-59213

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

CVE-2026-59214

Open WebUI: Stored web worker XSS via Pyodide

CVE-2026-59215

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

CVE-2026-59216

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

CVE-2026-59217

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

CVE-2026-59218

Open WebUI: Account enumeration via observable login timing discrepancy

CVE-2026-59219

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

CVE-2026-59220

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

CVE-2026-59221

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

CVE-2026-59222

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

CVE-2026-59223

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

CVE-2026-59224

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

CVE-2026-59225

Open WebUI: Arena task endpoints can bypass underlying model access controls

CVE-2026-59226

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

CVE-2026-59227

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

CVE-2026-59714

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

CVE-2026-59715

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

CVE-2025-46571

Open WebUI allows limited stored XSS vila uploaded html file

CVE-2025-46719

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

CVE-2026-26192

Open WebUI vulnerable to Stored XSS via iFrame in citations model

CVE-2026-26193

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

CVE-2026-34225

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

CVE-2026-54006

Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar

CVE-2026-54007

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

CVE-2026-54008

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)

CVE-2026-54009

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

CVE-2026-54010

Open WebUI: Forged chat-file link allows cross-user file read and deletion

CVE-2026-54011

Open WebUI: Stored XSS in Mermaid Markdown Preview

CVE-2026-54012

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

CVE-2026-54013

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

CVE-2026-54014

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}

CVE-2026-54015

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

CVE-2026-54016

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

CVE-2026-54017

Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

CVE-2026-54018

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

CVE-2026-54019

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

CVE-2026-54021

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

CVE-2026-54022

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

CVE-2026-45299

Open WebUI has Stored Cross-Site Scripting In Profile Picture

CVE-2026-45301

Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

CVE-2026-45303

Open WebUI has stored XSS via the HTML renedering view

CVE-2026-45314

Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

CVE-2026-45315

Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

CVE-2026-45316

Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)

CVE-2026-45317

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

CVE-2026-45318

Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

CVE-2026-45331

Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

CVE-2026-45338

Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

CVE-2026-45345

Open WebUI missing authorization check at the model update function - models from other users can be updated

CVE-2026-45347

Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function

CVE-2026-45349

Open WebUI has Broken Access Control for Completions API

CVE-2026-45350

Open WebUI's chat completion API allows tool restrictions to be bypassed

CVE-2026-45351

Open WebUI Exposes System Prompt to Regular User [Non-Admin]

CVE-2026-45365

Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]

CVE-2026-45385

Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint

CVE-2026-45386

Open WebUI has an IDOR vulnerability in the pin_channel_message API endpoint

CVE-2026-45387

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

CVE-2026-45396

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

CVE-2026-45397

Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure

CVE-2026-45398

Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls

CVE-2026-45399

Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption

CVE-2026-45400

Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`

CVE-2026-45401

Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)

CVE-2026-45402

Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

CVE-2026-45666

Open WebUI has an Indirect Object Reference (IDOR) in user notes

CVE-2026-45667

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

CVE-2026-45671

Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

CVE-2026-45672

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

CVE-2026-45675

Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

GHSA-3wgj-c2hg-vm6q

Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url

CVE-2026-44565

Open WebUI Arbitrary File Write, Delete via Path Traversal

CVE-2026-44569

Open WebUI's Insecure Message Access Breaks Authorization

CVE-2026-44570

Open WebUI has inconsistent authorization controls within memories API

CVE-2026-44571

Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission

GHSA-6xcp-7mpr-m7wm

Open WebUI has a CORS misconfiguration and session validation issue

CVE-2026-44549

Open WebUI has stored XSS in Excel file preview

CVE-2026-44550

Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

CVE-2026-44551

Open WebUI has an LDAP Empty Password Authentication Bypass

CVE-2026-44552

Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning

CVE-2026-44553

Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

CVE-2026-44554

Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

CVE-2026-44555

Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

CVE-2026-44556

Open WebUI's responses passthrough endpoint lacks access control authorization

CVE-2026-44557

Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

CVE-2026-44558

Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants

CVE-2026-44559

Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

CVE-2026-44560

Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

CVE-2026-44561

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

CVE-2026-44562

Open WebUI's Model Import Overwrites Any Model Without Ownership Check

CVE-2026-44563

Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

CVE-2026-44564

Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO

CVE-2026-44566

Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal

CVE-2026-44567

Open WebUI has Improper Authorization Control

CVE-2026-44568

Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

CVE-2026-44721

open-webui Vulnerable to Stored XSS via Model Description

CVE-2026-34222

Open WebUI has Broken Access Control in Tool Valves

CVE-2026-28786

Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

CVE-2026-28788

Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

CVE-2026-29070

Open WebUI has unauthorized deletion of knowledge files

CVE-2026-29071

Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

CVE-2025-63681

open-webui is Vulnerable to Incorrect Access Control

CVE-2025-65958

Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

CVE-2025-64495

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

CVE-2025-64496

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

CVE-2024-12534

Open WebUI Uncontrolled Resource Consumption vulnerability

CVE-2024-12537

Open WebUI Uncontrolled Resource Consumption vulnerability

CVE-2024-7035

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2024-7036

Open WebUI Uncontrolled Resource Consumption vulnerability

CVE-2024-7043

Open WebUI Allows Arbitrary File Reading and Deletion

CVE-2024-7044

Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload

CVE-2024-7045

Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read

CVE-2024-7046

Open WebUI Allows Viewing of Admin Details

CVE-2024-7053

Open WebUI Vulnerable to a Session Fixation Attack

CVE-2024-7806

Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability

CVE-2024-7983

Open WebUI denial of service through endpoint for converting markdown

CVE-2024-7990

Open WebUI stored cross-site scripting (XSS) vulnerability

CVE-2024-8053

Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint

CVE-2024-8060

Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

GHSA-5ccf-884p-4jjq

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

GHSA-6wj5-5pgr-jwq8

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file

GHSA-w466-2wfc-8g58

Open WebUI has vulnerable dependency on starlette via fastapi

CVE-2024-7037

open-webui allows writing and deleting arbitrary files

CVE-2024-7041

open-webui Insecure Direct Object Reference (IDOR) vulnerability

CVE-2024-6706

Open WebUI Stored Cross-Site Scripting Vulnerability