WS-2026-0094

Open WebUI 0.8.6 through 0.11.3: the terminal proxy /api/v1/terminals/serverid/path in backend/openwebui/routers/terminals.py forwarded any requested path to the Terminals orchestrator with the administrator-configured shared bearer key attached. An ordinary user who has been granted access to a...