6 matches found
PYSEC-2026-2741 Open WebUI Exposes System Prompt to Regular User [Non-Admin]
Summary A regular user non-admin can view the system prompt of the model which is set by an admin. Details When a regular user non-admin logs into the application, a http://IP:8080/api/models? web request is initiated by the application and in response, it reveals the system prompt of available...
PYSEC-2026-1727 Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt...
Insertion of Sensitive Information Into Sent Data
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through the getmodelbyid handler in routers/models.py. An attacker can read the admin-curated system prompt and other model behavior settings by sending a GET...
September 9, 2025—KB5065511 (Security-only update)
September 9, 2025—KB5065511 Security-only update Applies To Windows Server 2008 Premium Assurance Windows Secure Boot certificate expiration Important: Secure Boot certificates used by most Windows devices have started expiring in June 2026. This might affect the ability of certain personal and...
