PT-2026-110702

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has access to file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file...

CVE-2026-109287: Authorization Bypass Through User-Controlled Key

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109295: Inefficient Regular Expression Complexity

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grepknowledgefiles or grepchatfiles with a catastrophically backtracking...

CVE-2026-109300: Improper Neutralization of Input During Web Page Generation

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109283: Incorrect Authorization

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-109286: Origin Validation Error

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated...

CVE-2026-109289: Insufficient Session Expiration

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated...

CVE-2026-109291: Improper Neutralization of Input During Web Page Generation

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

CVE-2026-109292: Exposure of Sensitive Information to an Unauthorized Actor

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal...

CVE-2026-109296: Authorization Bypass Through User-Controlled Key

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing route...

CVE-2026-109284: Missing Authorization

Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/id/fork on chats th...

CVE-2026-109285: Incorrect Authorization

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109288: Improper Neutralization of Input During Web Page Generation

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-109290: Improper Neutralization of Input During Web Page Generation

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109293: Exposure of Sensitive Information to an Unauthorized Actor

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of...

CVE-2026-109294: Uncontrolled Resource Consumption

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, whi...

CVE-2026-109297: Uncontrolled Resource Consumption

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rul...

CVE-2026-109298: Uncontrolled Resource Consumption

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grepknowledgefiles with short...

CVE-2026-109299: Uncontrolled Resource Consumption

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update...

CVE-2026-109572: Missing Authorization

Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/serverid/path to list or stop other...