openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44562 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44562 Source advisory: SNYK:PYTHON-OPENWEBUI-16599157...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44562 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44562 Source advisory: GHSA-MQQ6-CQCX-38VG...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44562 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44562 Source advisory: OSV:GHSA-MQQ6-CQCX-38VG...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the importmodels process. An attacker can overwrite existing models owned by other users, modify their configuration, and escalate access by submitting crafted payloads to the...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44559 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44559 Source advisory: SNYK:PYTHON-OPENWEBUI-16599153...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44559 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44559 Source advisory: OSV:GHSA-C7WP-3QH5-55PV...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44559 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44559 Source advisory: GHSA-C7WP-3QH5-55PV...

Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Global Knowledge Base Enumeration via knowledge-bases Meta-Collection Affected Component Retrieval collection access validation: - backend/openwebui/routers/retrieval.py lines 2330-2355, validatecollectionaccess - backend/openwebui/routers/retrieval.py query endpoints, e.g. POST /query/doc Affect...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44557 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44557 Source advisory: SNYK:PYTHON-OPENWEBUI-16599154...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44557 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44557 Source advisory: GHSA-6C2X-GCP3-GP73...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44557 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44557 Source advisory: OSV:GHSA-6C2X-GCP3-GP73...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44554 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44554 Source advisory: SNYK:PYTHON-OPENWEBUI-16599155...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44554 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44554 Source advisory: GHSA-7R82-QHG4-6WVJ...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44554 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44554 Source advisory: OSV:GHSA-7R82-QHG4-6WVJ...

Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite Affected Component Retrieval web/YouTube processing endpoints: - backend/openwebui/routers/retrieval.py lines 1810-1837, processweb - backend/openwebui/routers/retrieval.py the parallel processyoutube endpoint -...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the processweb and processyoutube endpoints when the overwrite parameter is set to true and the collectionname is attacker-controlled. An attacker can overwrite or delete another user...

Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants

Channel Access Grants Bypass filterallowedaccessgrants Affected Component Channel creation and update endpoints: - backend/openwebui/routers/channels.py lines 291-340, createnewchannel - backend/openwebui/routers/channels.py lines 617-638, updatechannelbyid - backend/openwebui/models/channels.py...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44558 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44558 Source advisory: GHSA-7RJH-PX4V-5W55...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44558 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44558 Source advisory: OSV:GHSA-7RJH-PX4V-5W55...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44558 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44558 Source advisory: SNYK:PYTHON-OPENWEBUI-16599156...