CVE-2026-109288 Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-109288 Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-109288 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-109288 Source advisory: MEND:CVE-2026-109288...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287

Open WebUI versions 0.9.6 before 0.11.4 are vulnerable to an information disclosure flaw due to an authorization oversight. The application fails to verify that a supplied directory_id belongs to the requested knowledge base when accessing GET /api/v1/knowledge/{id}/files . An attacker with read ...

EUVD-2026-97589

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-109287 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-109287 Source advisory: MEND:CVE-2026-109287...

EUVD-2026-97588

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated...

CVE-2026-109286

Versions of Open WebUI from 0.7.0 before 0.11.4 are vulnerable to a cross-origin message handling flaw in the SyncStatsModal component. This vulnerability, categorized as an Origin Validation Error (CWE-346) , allows an attacker-controlled website to steal a signed-in user's session token by post...

CVE-2026-109286 Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated...

CVE-2026-109286 Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated...

CVE-2026-109286 Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated...

CVE-2026-109285

Open WebUI versions 0.6.0 before 0.11.4 are vulnerable to an improper access control flaw within the has_access_to_file function. The root cause is the retention of stale cached knowledge base references , which allows former collaborators to maintain unauthorized access to files. An attacker wit...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

EUVD-2026-97587

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109283

Open WebUI versions 0.11.1 before 0.11.4 are vulnerable to an authorization bypass in the OAuth token exchange endpoint. The flaw occurs because the system only reads role claims from the provider's userinfo response and retains the user's existing role if no new claim is found, failing to accoun...