2405 matches found
CVE-2026-87017
creationtimestamp| type| source ---|---|--- 2026-09-10 16:35:08+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-pcvc-8vrv-8q6w...
CVE-2026-88005
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...
CVE-2026-88006
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...
EUVD-2026-75177
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the search process. An attacker can obtain unauthorized access to the identifier, name, and description of knowledge bases by exploiting improper filter application in certain vecto...
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...
GHSA-PCVC-8VRV-8Q6W Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...
EUVD-2026-75178
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint...
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the chat completions process. An attacker can overwrite another user's message content by submitting a crafted request to the endpoint, causing the original message to be replace...
GHSA-FMQH-XP37-5HR8 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
EUVD-2026-75179
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin...
GHSA-JMC6-2WR8-H3WJ Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...
Improper Restriction of Rendered UI Layers or Frames
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the PortPreview process. An attacker can gain access to session tokens and take over user accounts by serving malicious scripts on a terminal server por...
EUVD-2026-75180
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader...
Server-side Request Forgery (SSRF)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the SafePlaywrightURLLoader process when the Playwright web loader engine is enabled. An attacker can access internal network resources and sensitive data by submitting a...
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...
GHSA-4V28-J6Q3-5M4R Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...