1543 matches found
Open WebUI 'LDAP Empty Password' - Authentication Bypass
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...
Open WebUI < 0.9.5 - Information Disclosure
Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714
CVE-2026-59714 describes a cross-channel message overwrite vulnerability in Open WebUI exposed by the chat-completions path. From v0.9.5 to before v0.10.0, an authenticated user could overwrite a message in a channel they do not belong to by using a channel: chat_id with a caller-supplied message...
CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
GHSA-FWG2-594C-JP42 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-FP3F-MC75-235C vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-71852 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-71870 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-XH95-F55M-82FW vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-6HM5-JGCP-P838 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-12075 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-12074 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-QVV7-CG9C-W4X3 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-12072 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-GM37-52C6-37MW vulnerabilities
Vulnerabilities for packages: open-webui...