PT-2026-59564

Summary Type: Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspace id/projects/project id and GET .../project id/stats gate access on require workspace memberworkspace id only, then resolve project id through ProjectService.getproject id /...

PT-2026-59566

Summary Type: Authorization bypass enabling destructive action. The DELETE /workspaces/workspace id endpoint is gated only by require workspace memberworkspace id default min role="member". Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project...

PT-2026-59561

Summary Type: Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspace id/labels/label id, DELETE .../labels/label id, POST .../issues/issue id/labels/label id, DELETE .../issues/issue id/labels/label id, GET .../issues/issue id/labels — gate access on require workspac...

PT-2026-59560

Summary Type: Insecure Direct Object Reference. The dependency endpoints POST/GET /workspaces/workspace id/issues/issue id/dependencies and DELETE .../dependencies/dep id gate access on require workspace memberworkspace id only, then dispatch to DependencyService calls that take URL/body-supplied...

PT-2026-59550

Bug Report: Arbitrary File Write in Python API Summary Hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. write file skips path validation when workspace=None always None in production. Affected PraisonAI output file: /tmp/flag.txt output...

PT-2026-59573

Summary PraisonAI's spider tools URL validation can be bypassed using alternate loopback host encodings. The affected component is: text praisonaiagents/tools/spider tools.py The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled...

PT-2026-59569

Summary Type: Authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspace id endpoint is gated only by require workspace memberworkspace id default min role="member". Any member can rewrite the workspace's name, description, and the settings JSON blob. T...

PT-2026-59404

Summary Open WebUI v0.9.5 lets an authenticated user attach arbitrary file id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has access to file treats the victim file as accessibl...

PT-2026-59346

Summary Open WebUI's prompt version-history endpoints authorize the prompt id in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that prompt history entry.prompt id == prompt.id. Three operations are affected: - GET /api/v1/prompts/id/prompt...

PT-2026-59925

Impact When RandomPoissonV2 receives large input shape and rates, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg 0=tf.random.uniformshape=4,, dtype=tf.int32, maxval=65536 arg 1=tf.random.uniformshape=4, 4, 4, 4, 4, dtype=tf.float32, maxval=No...

PT-2026-59374

Deactivated Channel Members Retain Full Access to Group/DM Channels Affected Component Channel membership authorization check: - backend/open webui/models/channels.py lines 663-673, is user channel member - Used at 15 locations in backend/open webui/routers/channels.py Affected Versions Current...

PT-2026-59188

Summary A resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service DoS via CPU exhaustion. When the library decrypts a JSON Web Encryption JWE token using Password-Based Encryption PBES2 algorithms, it reads the p2c PBES2 Count parameter directl...

PT-2026-59489

Summary A memory safety bug in the legacy OpenEXR Python adapter the deprecated OpenEXR.InputFile wrapper allow crashes and likely code execution when opening attacker-controlled EXR files or when passing crafted Python objects. Integer overflow and unchecked allocation in InputFile.channel and...

PT-2026-59224

Vulnerability IDOR in GET/PATCH/DELETE /api/v1/flow/flow id The read flow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTO LOGIN setting to decide whether to filter by user id. When AUTO LOGIN was False i.e., authentication was enabled, neither branch enforced an ownership...

PT-2026-59577

Summary The web crawl function in praisonaiagents/tools/web crawl tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker or prompt injection in crawled...

PT-2026-59403

Read-Only Users Can Modify Collaborative Documents via Socket.IO Affected Component Socket.IO collaborative document editing handler: - backend/open webui/socket/main.py lines 667-721, ydoc:document:update handler Affected Versions Current main branch and likely all versions with collaborative no...

PT-2026-59397

Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation Summary The POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses model config = ConfigDictextra='allow'. Due to an insecure...

ROS-20260713-73-0032

The vulnerability in Python-Relenv relates to the choice of a less secure algorithm during negotiation processes. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” type attack...

PT-2026-59012

Impact Aegra deployments running 0.9.0 through 0.9.6 with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated user User A, given another user's thread id User B, can: - Execute graph runs against User B's thread via POST /threads/thread...

PT-2026-59379

CONFIDENTIAL Vulnerability Disclosure Analysis Documentation ----------------------------------------------- Vulnerability Details --------------------- 1. Discoverer: Taylor Pennington of KoreLogic, Inc. 2. Date Submitted: June 11, 2024 3. Title: Open WebUI Arbitrary File Write, Delete via Path...