open-webui vulnerabilities

CVEs whose affected-version data names the open-webui package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

open-webui vulnerabilities

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)

Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)

Open WebUI Exposes System Prompt to Regular User [Non-Admin]

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

Open WebUI missing authorization check at the model update function - models from other users can be updated

Open WebUI has Broken Access Control for Completions API

Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function

Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`

Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption

Open WebUI has Stored Cross-Site Scripting In Profile Picture

Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure

Open WebUI has an IDOR vulnerability in the pin_channel_message API endpoint

Open WebUI has stored XSS via the HTML renedering view

Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

Open WebUI's chat completion API allows tool restrictions to be bypassed

Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

Open WebUI has a CORS misconfiguration and session validation issue

Open WebUI's Insecure Message Access Breaks Authorization