CVE-2026-87997 Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-87997 Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-59217 Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledgeid and auto-linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing...

FreeBSD-SA-03:01.cvs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:01.cvs Security Advisory The FreeBSD Project Topic: remotely exploitable vulnerability in cvs server Category: contrib Module: contribcvs Announced: 2003-02-04...