4667 matches found
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
SummaryAny member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
SummaryOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the...
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
SummaryAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, an...
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globall...
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this...
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
SummaryThe built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
SummaryWith the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
SummaryExternal knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for other...
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
SummaryThe chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder's id can put a chat of their own into another user's folder,...
CVE-2026-70481
CVE-2026-70481 Open WebUI 受影响版本为 0.5.0 至 0.10.2，已在 0.11.0 中修复。中危，CVSS 5.4，CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L，CWE-284 和 CWE-862。 在 backend/openwebui/routers/channels.py 中，消息更新和删除处理程序根据频道类型进行分支，而这两个分支提出的问题不同。群组和私信频道仅限作者本人操作。 if channel.type in 'group', 'dm': if not await...
CVE-2026-33340
CVE-2026-33340: SSRF en lollms-webui Descripción general Campo| Detalle ---|--- ID CVE| CVE-2026-33340 Vulnerabilidad| Falsificación de solicitudes del lado del servidor Server-Side Request Forgery, SSRF Producto afectado| ParisNeo/lollms-webui LoLLMS WEBUI Gravedad| Crítica — CVSS 9.1 Vector CVS...
POC_CVE-2024-4322
CVE-2024-4322：LoLLMS WebUI PoC 与 Nuclei 验证实验室 本仓库提供 Docker 化的本地实验室，用于复现 CVE-2024-4322 （LoLLMS WebUI v9.6 中的一个路径遍历漏洞），并验证相关的 Nuclei 模板不会匹配 LoLLMS WebUI v9.8。 请仅对本地、自有或明确授权的目标使用此实验室。 漏洞摘要 LoLLMS WebUI v9.6 中的 /listpersonalities 端点存在路径遍历漏洞。用户可控的 category 参数未经净化处理即被追加到 personalitieszoopath：...
CVE-2026-49265 vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, kubeflow-volumes-web-app, kubeflow-katib, open-webui, kubeflow-pipelines-visualization-server, kubeflow-pipelines, dask-kubernetes, kserve, jupyter-base-notebook, datadog-agent, k8s-sidecar, az, ggshield...
GHSA-XPV3-W29H-X7CV vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, kubeflow-volumes-web-app, kubeflow-katib, open-webui, kubeflow-pipelines-visualization-server, kubeflow-pipelines, dask-kubernetes, kserve, jupyter-base-notebook, datadog-agent, k8s-sidecar, az, ggshield...
CVE-2026-102268 vulnerabilities
Vulnerabilities for packages: open-webui, superset, kserve, semgrep, datadog-agent, py3-cassandra-medusa, ggshield...
CVE-2026-102269 vulnerabilities
Vulnerabilities for packages: open-webui, superset, kserve, semgrep, datadog-agent, py3-cassandra-medusa, ggshield...
GHSA-FFC3-869F-JXW9 vulnerabilities
Vulnerabilities for packages: open-webui, superset, kserve, semgrep, datadog-agent, py3-cassandra-medusa, ggshield...
CVE-2026-102272 vulnerabilities
Vulnerabilities for packages: open-webui, superset, kserve, semgrep, datadog-agent, py3-cassandra-medusa, ggshield...