| Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpointsCVE-2026-45339 · GHSA-57Q6-FVP4-PQMMVersion ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI has vulnerable dependency on starlette via fastapiGHSA-W466-2WFC-8G58 |
open-webui |
PyPI |
High
|
Fix reported |
|
| Open WebUI Stored Cross-Site Scripting VulnerabilityCVE-2024-6706 · GHSA-5JP3-WP5V-5363Version ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| open-webui Insecure Direct Object Reference (IDOR) vulnerabilityCVE-2024-7041 · GHSA-XCVC-5HGV-PHQGVersion ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchangeCVE-2026-88005 · GHSA-4QG5-CXX4-G927Version ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Any authenticated user can inject chats into another user's folder via chat completionsCVE-2026-87997 · GHSA-3PF7-Q2G3-WJ28Version ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetchCVE-2026-87999 · GHSA-34R3-9M95-VQ73Version ranges need review. |
open-webui |
PyPI |
High
|
Fix reported |
|
| Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loaderCVE-2026-87996 · GHSA-4V28-J6Q3-5M4RVersion ranges need review. |
open-webui |
PyPI |
High
|
Fix reported |
|
| Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletionCVE-2026-87998 · GHSA-2724-6CPJ-GF3VVersion ranges need review. |
open-webui |
PyPI |
High
|
Fix reported |
|
| Open WebUI: Channel members can overwrite another member's message via the chat completions endpointCVE-2026-87994 · GHSA-FMQH-XP37-5HR8Version ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: A user's session cookies are sent to tool servers configured for bearer authenticationCVE-2026-87015 · GHSA-P78M-89R6-PGF7Version ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Users denied by the OAuth role policy can still sign in via token exchangeCVE-2026-88006 · GHSA-WVM9-9G5J-623FVersion ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originCVE-2026-87995 · GHSA-JMC6-2WR8-H3WJVersion ranges need review. |
open-webui |
PyPI |
High
|
Fix reported |
|
| Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notesCVE-2026-87014 · GHSA-WJWR-XFP9-R66PVersion ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycleCVE-2026-87013 · GHSA-8R35-5X5R-HV74Version ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteCVE-2026-87016 · GHSA-WPMR-8H3Q-FWJ7Version ranges need review. |
open-webui |
PyPI |
High
|
Fix reported |
|
| Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valueCVE-2026-87012 · GHSA-V39V-59XW-J98GVersion ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutCVE-2026-87011 · GHSA-3G9Q-V48F-HH9WVersion ranges need review. |
open-webui |
PyPI |
High
|
Fix reported |
|
| Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backendsCVE-2026-87017 · GHSA-PCVC-8VRV-8Q6WVersion ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
| Open WebUI: Any authenticated user can hang the server via a cyclic chat message historyCVE-2026-88002 · GHSA-JQHH-CJMQ-VMV6Version ranges need review. |
open-webui |
PyPI |
Medium
|
Fix reported |
|
