2313 matches found
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
SummaryA user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
SummaryAny authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at...
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value SummaryCalendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object i...
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
SummaryThe OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network,...
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
SummaryOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the...
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
SummaryAny member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
SummaryAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, an...
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globall...
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this...
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
SummaryThe chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder's id can put a chat of their own into another user's folder,...
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
SummaryThe built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
SummaryWith the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
SummaryExternal knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for other...
CVE-2026-70481
CVE-2026-70481 Open WebUI 受影响版本为 0.5.0 至 0.10.2，已在 0.11.0 中修复。中危，CVSS 5.4，CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L，CWE-284 和 CWE-862。 在 backend/openwebui/routers/channels.py 中，消息更新和删除处理程序根据频道类型进行分支，而这两个分支提出的问题不同。群组和私信频道仅限作者本人操作。 if channel.type in 'group', 'dm': if not await...
CVE-2026-49265 vulnerabilities
Vulnerabilities for packages: ggshield, k8s-sidecar, open-webui, dask-kubernetes, datadog-agent, kubeflow-katib, az, kubeflow-pipelines, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, kserve, kubeflow-jupyter-web-app, jupyter-base-notebook...
GHSA-XPV3-W29H-X7CV vulnerabilities
Vulnerabilities for packages: ggshield, k8s-sidecar, open-webui, dask-kubernetes, datadog-agent, kubeflow-katib, az, kubeflow-pipelines, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, kserve, kubeflow-jupyter-web-app, jupyter-base-notebook...
CVE-2026-102269 vulnerabilities
Vulnerabilities for packages: ggshield, open-webui, semgrep, datadog-agent, superset, kserve, py3-cassandra-medusa...