1553 matches found
GHSA-RQ84-P6RR-VF89 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...
CVE-2026-70482 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLEOAUTHTOKENEXCHANGE=True, /oauth/provider/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which...
CVE-2026-70482
Open WebUI (self-hosted AI platform) versions 0.8.0–0.11.0 are affected. When ENABLE_OAUTH_TOKEN_EXCHANGE is true, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it via the provider’s userinfo endpoint without confirming which OAuth client issued the token. As ...
CVE-2026-70482 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLEOAUTHTOKENEXCHANGE=True, /oauth/provider/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which...
CVE-2026-70481 Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access i...
CVE-2026-70481
CVE-2026-70481 affects Open WebUI prior to 0.11.0. In standard channels, the update and delete message handlers allowed any user with write access to a channel to rewrite or permanently delete other users’ messages, because the standard branch checked only write permission, not message authorship...
CVE-2026-70480
Open WebUI prior to 0.11.0 renders Vega/Vega-Lite blocks in chat without restricted resource loading, enabling client-side SSRF: an attacker-blocked block can force the victim’s browser to issue attacker-controlled outbound GETs and read responses from same-origin or permissive CORS targets. Affe...
CVE-2026-70480 Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such ...
CVE-2026-70480 Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such ...
Server-side Request Forgery (SSRF)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the SafePlaywrightURLLoader process. An attacker can access sensitive internal resources by submitting a crafted URL when the Playwright web loader is enabled, allowing th...
GHSA-W2RX-84HP-GG95 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...
CVE-2026-70479 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
SummaryThe getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...
PYSEC-2026-3589 Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
Summary The getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...
CVE-2026-59212
creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:07+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-2xwm-4h2q-ggfx...
GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...
GHSA-M3QF-58WF-W979 Open WebUI: Arena task endpoints can bypass underlying model access controls
Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...
EUVD-2026-42634
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete...