open-webui vulnerabilities

CVEs whose affected-version data names the open-webui package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

open-webui vulnerabilities

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI allows limited stored XSS vila uploaded html file

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

Open WebUI vulnerable to Stored XSS via iFrame in citations model

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI: Forged chat-file link allows cross-user file read and deletion

Open WebUI: Stored XSS in Mermaid Markdown Preview

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url

Open WebUI has an Indirect Object Reference (IDOR) in user notes

Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint

Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]