The vulnerability of the validate_url() function (backend/open_webui/retrieval/web/utils.py) in the Open WebUI AI-based web interface allows a attacker to perform an SSRF attack.

The vulnerability of the validateurl function backend/openwebui/retrieval/web/utils.py in the Open WebUI AI-based web interface is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

Vulnerability of the _process_picture_url() function (backend/open_webui/utils/oauth.py) in the Open WebUI AI-based web interface, which allows a hacker to perform an SSRF attack

The vulnerability of the processpictureurl function backend/openwebui/utils/oauth.py in the Open WebUI AI-based web interface is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

The vulnerability in the Open WebUI web interface, related to the manipulation of cross-site requests, allows a perpetrator to perform a CSRF attack or cause a service failure.

The vulnerability of the Open WebUI web interface is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack or cause a service failure...

The vulnerability of the Open WebUI web interface, based on artificial intelligence, arises from deficiencies in the authentication process, allowing attackers to execute arbitrary code.

The vulnerability of the Open WebUI web interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the get_status() function in the Open WebUI web interface allows a hacker to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the getstatus function in the Open WebUI web interface is related to the lack of authentication for the critical function. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

Exploit for Allocation of Resources Without Limits or Throttling in Openwebui Open_Webui

CVE-2024-12537 Open WebUI Code Format DoS Lab This repository...

Improper Authorization

Open WebUI is vulnerable to improper authorization. The vulnerability is due to improper validation of authorized user roles in the API, which allows a pending user account to bypass intended access restrictions and gain unauthorized access to the web application...

The vulnerability of the Open WebUI web interface, based on artificial intelligence, relates to errors in information processing, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Open WebUI-based web interface is related to errors in information processing. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the has_access_to_file() function in the Open WebUI artificial intelligence-based web interface allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the hasaccesstofile function in the Open WebUI artificial intelligence-based web interface relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

The vulnerability in the Open WebUI web interface, related to bypassing authentication using a user-controlled key, allows attackers to gain read, modify, or delete access to data.

The vulnerability in the Open WebUI web interface relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, or delete data...

The vulnerability of the Open WebUI web interface, based on artificial intelligence, arises from deficiencies in access control. This allows attackers to gain read, modify, and delete access to data.

The vulnerability of the Open WebUI web interface is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain read, modify, and delete access to data...

The vulnerability of the Banner component in the Open WebUI web interface allows a hacker to manipulate inter-site requests and intercept the administrator’s session.

The vulnerability of the Banner web interface component based on artificial intelligence, Open WebUI, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to manipulate inter-site requests and intercept the administrator...

The vulnerability of the Open WebUI web interface, based on artificial intelligence, relates to errors in information processing, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Open WebUI-based web interface is related to errors in information processing. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

MAL-2026-4742 Malicious code in aurapro-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cace553d74971e3660a0a7095662488f531348ba3e756696da5ff0ef9645ab22 The PyPI package aurapro-ui installs its code under the Python import namespace openwebui/ and registers two console scripts in entrypoints.txt —...

Malicious code in aurapro-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cace553d74971e3660a0a7095662488f531348ba3e756696da5ff0ef9645ab22 The PyPI package aurapro-ui installs its code under the Python import namespace openwebui/ and registers two console scripts in entrypoints.txt —...

CVE-2026-45315

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHEDIR/audio/transcriptions/.. The /cache/path route serve...

CVE-2026-45386

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/Unpin is a write operation modifies the message's ispinned , pinnedby, pinnedat fields, but in standard channels it only checks read permission, allowing users with read-only...

CVE-2026-45349

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API key generated in OWUI and the Chat ID of another user to continue the conversation of the other...

CVE-2026-44721

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a stored cross-site scripting XSS vulnerability that allows any authenticated user with model creation permission workspace.models to execute arbitrary JavaScript in the browser of a...

CVE-2026-45402

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied fileid and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the...