CVE-2025-63681

creationtimestamp| type| source ---|---|--- 2025-12-04 18:41:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m76mpsverh26...

CVE-2025-63681

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...