4344 matches found
EUVD-2026-42634
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete...
Protection Mechanism Failure
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Protection Mechanism Failure through improper matching of hostnames in the WEBFETCHFILTERLIST process. An attacker can access hosts that should be blocked or bypass allowlists by crafting URLs with specific...
EUVD-2026-42633
Open WebUI: WEBFETCHFILTERLIST host allow/block filter bypassable via URL path and non-label-boundary matching...
EUVD-2026-42631
Open WebUI: /api/v1/channels/id/members exposes full user model including sensitive credentials...
Information Exposure
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure via the GET /api/v1/channels/id/members endpoint. An attacker can access sensitive configuration data, including webhook URLs and tool server credentials belonging to other users, by maki...
GHSA-73X5-H92W-XC2J Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding
Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/id/messages/messageid/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without...
Authorization Bypass Through User-Controlled Key
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the getmessagesbyparentid process. An attacker can access the content, channel ID, and author metadata of messages in private channels they do not belong t...
Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding
Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/id/messages/messageid/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without...
EUVD-2026-42630
Open WebUI: Private channel messages can be disclosed through cross-channel thread parentid binding...
EUVD-2026-42629
Open WebUI: Cross-user model-list exposure via static cache key in getallmodels aiocache key= vs keybuilder= misuse...
Use of Cache Containing Sensitive Information
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the getallmodels process due to improper cache key configuration, which causes permission-filtered model lists to be shared across users. An attacker can acces...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the processuploadedfile process. An attacker can modify the file membership of a knowledge base without proper authorization by supplying a crafted metadata.knowledgeid value during...
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the sessio...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the geteventcall process. An attacker can execute arbitrary code and tools in another user's authenticated session by supplying a victim's sessionid and leveraging the lack of...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the chat completion process. An attacker can overwrite messages in channels they do not belong to, including private and direct message channels, by supplying a crafted chatid an...
EUVD-2026-42625
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout...
Insufficient Session Expiration
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Insufficient Session Expiration in the realtime authentication process. An attacker can maintain unauthorized access to realtime features by using a JWT that has been revoked via sign-out or back-channel...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization via the /api/v1/images/edit route. An attacker can trigger server-side image editing operations using administrator-configured credentials, even when global image editing is disabled o...