Open WebUI Open Webui

Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Open WebUI: Stored Cross-Site Scripting In Profile Picture

Open WebUI: Unauthenticated RAG Configuration Disclosure

Open WebUI: Account enumeration via observable login timing discrepancy

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels

Open WebUI: Calendar event re-parenting allows writing events into another user's calendar

Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint

Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.

Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability

Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability

Remote Code Execution by Non-Admin Users via CSRF in open-webui/open-webui

Exposure of Token in open-webui/open-webui

Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability