RoboTask REST API unauthenticated task execution

RoboTask REST API default port 9999 with RestUseApiKeys=0 accepts unauthenticated POST /api/tasks/id/run and executes preconfigured task actions with the RoboTask service privilege. !/usr/bin/env python3 -- coding: utf-8 -- """RoboTask REST API unauthenticated remote task execution CWE-306.""" fr...

CVE-2026-45399

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate active background tasks across the system and stop tasks belonging to other users via the GET /api/tasks and POST...

CVE-2026-45399

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate active background tasks across the system and stop tasks belonging to other users via the GET /api/tasks and POST...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the GET /api/tasks and POST /api/tasks/stop/taskid endpoints, which lack proper ownership checks. An attacker can enumerate and terminate background tasks belonging to other users by...

CVE-2025-63681: Improper Access Control

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...

CVE-2025-63681

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...

EUVD-2024-43568

Malicious code in bioql PyPI...

CVE-2018-9998: Exposure of Sensitive Information to an Unauthorized Actor

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...

PT-2018-19159

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.6.3-rev37 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev40 Open-Xchange OX App Suite version 7.8.3 prior to 7.8.3-rev48 Open-Xchange OX App Suite version 7.8.4 prior to 7.8.4-rev28...

Open redirect

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...

PT-2018-17129

Name of the Vulnerable Software and Affected Versions: Open-Xchange OX App Suite versions prior to 7.6.3-rev36 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev39 Open-Xchange OX App Suite versions 7.8.3 prior to 7.8.3-rev44 Open-Xchange OX App Suite versions 7.8.4 prior to 7.8.4-rev22...

CVE-2018-5756: Improper Privilege Management

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...