EUVD-2026-97595

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of...

CVE-2026-109293

Open WebUI versions 0.11.0 through 0.11.3 are vulnerable to an information disclosure flaw via the Tool Export Endpoint . Authenticated non-admin users with tool export permissions can use a GET request to /api/v1/tools/export to retrieve the full Python source code of read-only shared tools. Thi...

EUVD-2026-97589

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287

Open WebUI versions 0.9.6 before 0.11.4 are vulnerable to an information disclosure flaw due to an authorization oversight. The application fails to verify that a supplied directory_id belongs to the requested knowledge base when accessing GET /api/v1/knowledge/{id}/files . An attacker with read ...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-109182

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109184

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to vie...

CVE-2026-109181

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing...

CVE-2026-109179

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions...

CVE-2026-109184

The software jshERP through version 3.6 is vulnerable to an improper authorization (CWE-862) flaw. Low-privilege authenticated users can bypass data scope restrictions to read any settlement account ledger by providing an arbitrary accountId via the GET /account/findAccountInOutList endpoint. Thi...

EUVD-2026-97388

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to vie...

EUVD-2026-97386

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109182

jshERP versions through 3.6 are affected by an incorrect authorization vulnerability (CWE-863) in the GET /supplier/exportExcel endpoint. While the /supplier/list endpoint correctly enforces role data scope restrictions, this specific export function fails to do so. This allows authenticated user...

CVE-2026-109181

The jshERP software, versions through 3.6 , is affected by an authorization bypass vulnerability. An authenticated user restricted to personal or department data can access other users' bills by including a purchaseStatus=0 value in the search JSON on the GET /depotHead/list endpoint. This input ...

CVE-2026-109181 jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing...

EUVD-2026-97385

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing...