4667 matches found
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at...
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
SummaryA user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
SummaryAny authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
SummaryThe OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network,...
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value SummaryCalendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object i...
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
SummaryAny member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
SummaryOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the...
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
SummaryAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, an...
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this...
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globall...
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
SummaryThe chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder's id can put a chat of their own into another user's folder,...
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
SummaryThe built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
SummaryWith the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
SummaryExternal knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for other...
CVE-2026-70481
CVE-2026-70481 Open WebUI, 영향을 받는 버전은 0.5.00.10.2이며, 0.11.0에서 패치되었습니다. 심각도 Moderate, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 및 CWE-862. backend/openwebui/routers/channels.py에서 메시지 업데이트 및 삭제 핸들러는 채널 유형에 따라 분기하며, 두 분기는 서로 다른 조건을 검사합니다. 그룹 및 직접 메시지 채널은 작성자에게만 허용됩니다. if...
CVE-2026-33340
CVE-2026-33340: lollms-webui의 SSRF 취약점 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-33340 취약점| 서버 측 요청 위조 SSRF 영향받는 제품| ParisNeo/lollms-webui LoLLMs WEBUI 심각도| Critical — CVSS 9.1 CVSS 벡터| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918: 서버 측 요청 위조 SSRF 영향받는 구성 요소|...
POC_CVE-2024-4322
CVE-2024-4322: LoLLMS WebUI PoC 및 Nuclei 검증 랩 이 저장소는 CVE-2024-4322LoLLMS WebUI v9.6의 경로 탐색path traversal 취약점를 재현하고, 관련 Nuclei 템플릿이 LoLLMS WebUI v9.8과 일치하지 않음을 검증하기 위한 Docker 기반 로컬 랩을 제공합니다. 이 랩은 로컬, 소유, 또는 명시적으로 승인된 대상에 대해서만 사용하십시오. 취약점 요약 LoLLMS WebUI v9.6의 /listpersonalities 엔드포인트는 경로 탐색path...
CVE-2026-49265 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, jupyter-base-notebook, kubeflow-jupyter-web-app, kubeflow-volumes-web-app, dask-kubernetes, k8s-sidecar, kubeflow-pipelines, ggshield, open-webui, kubeflow-katib, kserve, datadog-agent, az...
GHSA-XPV3-W29H-X7CV vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, jupyter-base-notebook, kubeflow-jupyter-web-app, kubeflow-volumes-web-app, dask-kubernetes, k8s-sidecar, kubeflow-pipelines, ggshield, open-webui, kubeflow-katib, kserve, datadog-agent, az...