3445 matches found
CVE-2026-88006
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...
CVE-2026-88005
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87017 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87017 Source advisory: GHSA-PCVC-8VRV-8Q6W...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87017 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87017 Source advisory: SNYK:PYTHON-OPENWEBUI-20158696...
EUVD-2026-75177
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends...
GHSA-PCVC-8VRV-8Q6W Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87017 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87017 Source advisory: OSV:GHSA-PCVC-8VRV-8Q6W...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the search process. An attacker can obtain unauthorized access to the identifier, name, and description of knowledge bases by exploiting improper filter application in certain vecto...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87994 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87994 Source advisory: OSV:GHSA-FMQH-XP37-5HR8...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87994 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87994 Source advisory: SNYK:PYTHON-OPENWEBUI-20158695...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87994 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87994 Source advisory: GHSA-FMQH-XP37-5HR8...
EUVD-2026-75178
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint...
GHSA-FMQH-XP37-5HR8 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the chat completions process. An attacker can overwrite another user's message content by submitting a crafted request to the endpoint, causing the original message to be replace...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87995 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87995 Source advisory: GHSA-JMC6-2WR8-H3WJ...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87995 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87995 Source advisory: OSV:GHSA-JMC6-2WR8-H3WJ...
hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87995 via open-webui (0.11.0)
open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87995 Source advisory: SNYK:PYTHON-OPENWEBUI-20158694...