CVE-2026-102994 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-JHR6-GM9C-RQJV vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-68770 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-68770 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-JHR6-GM9C-RQJV vulnerabilities

Vulnerabilities for packages: open-webui...

lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

SummaryThe LightRAG WebUI renders assistant/answer chat content as raw HTML — react-markdown isconfigured with rehypePlugins=rehypeRaw and skipHtml=false and no HTML sanitizerrehype-sanitize, element allow-list, or custom urlTransform. Because answer content is derivedfrom user-ingested documents...

PYSEC-2026-4065 lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

Summary The LightRAG WebUI renders assistant/answer chat content as raw HTML — react-markdown is configured with rehypePlugins=rehypeRaw and skipHtml=false and no HTML sanitizer rehype-sanitize, element allow-list, or custom urlTransform. Because answer content is derived from user-ingested...

PYSEC-2026-4121 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

PYSEC-2026-4117 Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

PYSEC-2026-4126 Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Summary Calendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object ...

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

SummaryAny authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

SummaryWhen more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callable...

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value SummaryCalendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object i...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at...

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

SummaryThe OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network,...

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

SummaryA user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

PYSEC-2026-4129 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PYSEC-2026-4127 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

PYSEC-2026-4124 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this...