Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Unauthorized File and Knowledge Base Content Access via RAG Vector Search Affected Component RAG source resolution in chat completion pipeline: - backend/openwebui/retrieval/utils.py lines 963-965, 1063-1068, 1126-1131 in getsourcesfromitems Affected Versions Current main branch commit 6fdd19bf1...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44561 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44561 Source advisory: SNYK:PYTHON-OPENWEBUI-16599161...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44561 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44561 Source advisory: GHSA-HMGR-67HW-J2CQ...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44561 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44561 Source advisory: OSV:GHSA-HMGR-67HW-J2CQ...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the isuserchannelmember function. An attacker can retain unauthorized read and write access to group or direct message channels by making direct API calls after being deactivated fr...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44564 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44564 Source advisory: OSV:GHSA-VRFH-RJ4Q-RMHR...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44564 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44564 Source advisory: GHSA-VRFH-RJ4Q-RMHR...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44564 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44564 Source advisory: SNYK:PYTHON-OPENWEBUI-16599147...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the generatecompletion, embed, embeddings, and showmodelinfo functions. An attacker can access restricted model information and consume compute resources by sending crafted API reques...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44563 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44563 Source advisory: SNYK:PYTHON-OPENWEBUI-16599149...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44563 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44563 Source advisory: GHSA-RCVP-6FGW-C7FH...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44563 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44563 Source advisory: OSV:GHSA-RCVP-6FGW-C7FH...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44562 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44562 Source advisory: OSV:GHSA-MQQ6-CQCX-38VG...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the importmodels process. An attacker can overwrite existing models owned by other users, modify their configuration, and escalate access by submitting crafted payloads to the...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44562 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44562 Source advisory: SNYK:PYTHON-OPENWEBUI-16599157...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44562 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44562 Source advisory: GHSA-MQQ6-CQCX-38VG...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44559 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44559 Source advisory: GHSA-C7WP-3QH5-55PV...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44559 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44559 Source advisory: OSV:GHSA-C7WP-3QH5-55PV...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44559 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44559 Source advisory: SNYK:PYTHON-OPENWEBUI-16599153...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44557 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44557 Source advisory: OSV:GHSA-6C2X-GCP3-GP73...