2407 matches found
CVE-2026-55830 vulnerabilities
Vulnerabilities for packages: open-webui, litellm...
GHSA-FFG3-P8FM-MJX2 vulnerabilities
Vulnerabilities for packages: open-webui, litellm...
PT-2026-89179
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.5.0 through 0.11.0 Description A flaw exists in the message-chain reconstruction helper located in backend/open webui/utils/misc.py. The system reconstructs chat history by map key but tracks visited entries using an...
PT-2026-89178
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An authenticated user can perform a Server-Side Request Forgery SSRF attack when the AIOHTTP CLIENT ALLOW REDIRECTS variable is set to true. The platform fails to reapply the WEB FETCH FILTE...
PT-2026-89158
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An asymmetric resource consumption issue exists in the OIDC back-channel logout handler. When the ENABLE OAUTH BACKCHANNEL LOGOUT setting is enabled and an OIDC provider is configured, the...
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
EUVD-2026-58246
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714
CVE-2026-59714 describes a cross-channel message overwrite vulnerability in Open WebUI exposed by the chat-completions path. From v0.9.5 to before v0.10.0, an authenticated user could overwrite a message in a channel they do not belong to by using a channel: chat_id with a caller-supplied message...
CVE-2026-59714: Missing Authorization
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
GHSA-FWG2-594C-JP42 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-71852 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-FP3F-MC75-235C vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-71870 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-12074 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-6HM5-JGCP-P838 vulnerabilities
Vulnerabilities for packages: open-webui...