{"kind": "product", "path": "vulns/pypi/open-webui", "name": "open-webui", "product": "open-webui", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-88006", "noindex": false, "published": "2026-09-10T14:43:17.538Z", "modified": "2026-09-10T17:46:41.061Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00371, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-88006", "title": "Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-wvm9-9g5j-623f", "https://github.com/open-webui/open-webui/commit/d799e81edbdc971c6deb096b6474cd95b93504bf", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-88005", "noindex": false, "published": "2026-09-10T14:38:52.367Z", "modified": "2026-09-15T14:35:40.830Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00371, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-88005", "title": "Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this endpoint. This issue is fixed in version 0.9.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-4qg5-cxx4-g927", "https://github.com/open-webui/open-webui/pull/23639", "https://github.com/open-webui/open-webui/commit/fb5ef978bfb451c3f2221931e08e54250cec58ca"], "fixes": ["0.9.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-88002", "noindex": false, "published": "2026-09-09T21:40:06.412Z", "modified": "2026-09-14T18:41:05.853Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00583, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-88002", "title": "Open WebUI: Any authenticated user can hang the server via a cyclic chat message history", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6", "https://github.com/open-webui/open-webui/pull/28034", "https://github.com/open-webui/open-webui/commit/5c79ccc9e5c9efc2bc024d8f0b9757652ece929a"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-88001", "noindex": false, "published": "2026-09-09T21:38:05.062Z", "modified": "2026-09-10T13:41:56.218Z", "cvss": 5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.00378, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-88001", "title": "Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated user could redirect the aiohttp and requests fetch paths to excluded hosts, loopback, private networks, or cloud metadata services and route resulting content into web search, URL ingestion, page-fetch tools, or chat image processing. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-5x7x-4c3c-qf5w", "https://github.com/open-webui/open-webui/pull/27823", "https://github.com/open-webui/open-webui/commit/e3e4bd87df6fc629e7e22081d980d55a7632b8b7"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-88000", "noindex": false, "published": "2026-09-09T21:35:25.061Z", "modified": "2026-09-10T17:53:04.924Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00592, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-88000", "title": "Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to follow childrenIds without recording visited message identifiers. An authenticated user could store a cyclic chat tree and delete a message, causing a synchronous infinite loop on the server request loop that blocked every user's requests until the process was killed. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-3cgp-3cqx-j8w2", "https://github.com/open-webui/open-webui/pull/28035", "https://github.com/open-webui/open-webui/commit/b933292d63d12be3fd1416fe55519ddc7aa336bc"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87999", "noindex": false, "published": "2026-09-09T21:33:18.322Z", "modified": "2026-09-10T15:35:54.372Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.0036, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87999", "title": "Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-34r3-9m95-vq73", "https://github.com/open-webui/open-webui/pull/27823", "https://github.com/open-webui/open-webui/commit/e3e4bd87df6fc629e7e22081d980d55a7632b8b7"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87998", "noindex": false, "published": "2026-09-09T21:31:48.454Z", "modified": "2026-09-10T17:48:07.956Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "severity": "high", "epss": 0.00486, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87998", "title": "Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-2724-6cpj-gf3v", "https://github.com/open-webui/open-webui/pull/28113", "https://github.com/open-webui/open-webui/commit/dc03e7e595d61be97b25a1dd7bb99ad264f73199"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87997", "noindex": false, "published": "2026-09-09T21:30:09.334Z", "modified": "2026-09-14T13:44:20.104Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87997", "title": "Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-3pf7-q2g3-wj28", "https://github.com/open-webui/open-webui/pull/28366", "https://github.com/open-webui/open-webui/commit/d9e23b90c100d19b00270aea3cde0501d2354a6c"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87996", "noindex": false, "published": "2026-09-09T21:28:10.758Z", "modified": "2026-09-10T13:48:24.214Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00354, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87996", "title": "Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r", "https://github.com/open-webui/open-webui/pull/28634", "https://github.com/open-webui/open-webui/commit/27402ff210bfa253445720920dfb86b15a00327b"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87995", "noindex": false, "published": "2026-09-09T21:26:30.890Z", "modified": "2026-09-10T17:54:56.492Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00417, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87995", "title": "Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-jmc6-2wr8-h3wj", "https://github.com/open-webui/open-webui/commit/54d7a223707f03172efbb9e754db6e69709956d0", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87994", "noindex": false, "published": "2026-09-09T21:24:55.896Z", "modified": "2026-09-10T15:59:55.721Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87994", "title": "Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user authored the targeted message. A channel member could use the chat completions endpoint to replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-fmqh-xp37-5hr8", "https://github.com/open-webui/open-webui/pull/28631", "https://github.com/open-webui/open-webui/commit/7d392bedc9c1aaecc94509a58e59186b614433dc"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87017", "noindex": false, "published": "2026-09-09T21:23:27.489Z", "modified": "2026-09-10T17:48:13.471Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87017", "title": "Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filter. An authenticated user on an affected backend could enumerate the identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection, although the associated document text remained in separate collections. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-pcvc-8vrv-8q6w", "https://github.com/open-webui/open-webui/commit/1d6d4e6e6647e1d403438ede7bd9ba20bc4cc8f6", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87016", "noindex": false, "published": "2026-09-09T21:21:43.877Z", "modified": "2026-09-14T13:43:30.787Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00599, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87016", "title": "Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "https://github.com/open-webui/open-webui/pull/28624", "https://github.com/open-webui/open-webui/commit/73c1f5806aeb6345dad5de8f5aa26d1f3d0bef80"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87015", "noindex": false, "published": "2026-09-09T21:03:34.145Z", "modified": "2026-09-10T13:50:33.969Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00478, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87015", "title": "Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-p78m-89r6-pgf7", "https://github.com/open-webui/open-webui/pull/28630", "https://github.com/open-webui/open-webui/commit/cd9db21c5276807a2975ddba17cef369ad1114b7"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87014", "noindex": false, "published": "2026-09-09T21:01:39.505Z", "modified": "2026-09-10T17:57:17.765Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00513, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87014", "title": "Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator demoted through a trusted role header or OAuth role mapping could keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closed. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-wjwr-xfp9-r66p", "https://github.com/open-webui/open-webui/commit/ce3c175e260709f359d7e6cbb3132f0572098b95", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87013", "noindex": false, "published": "2026-09-09T21:00:15.466Z", "modified": "2026-09-10T15:40:31.053Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00484, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87013", "title": "Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read did not track visited folder identifiers. An authenticated user could persist a parent cycle and start a request that consumed CPU and memory indefinitely, with the condition remaining stored until repaired. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-8r35-5x5r-hv74", "https://github.com/open-webui/open-webui/pull/28748", "https://github.com/open-webui/open-webui/commit/23b3a69bc26839bfa74edd1be6bfa2568ae902f4"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87012", "noindex": false, "published": "2026-09-09T20:57:58.794Z", "modified": "2026-09-10T17:48:20.357Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00484, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87012", "title": "Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An authenticated user with the calendar permission could store a non-numeric alert_minutes value that raised an exception and aborted the instance-wide alert pass, suppressing all users' reminders while the event remained in the lookahead window. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-v39v-59xw-j98g", "https://github.com/open-webui/open-webui/pull/28790", "https://github.com/open-webui/open-webui/commit/abc69000b33b4894fbd97fc2c962139cf9a8d784"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87011", "noindex": false, "published": "2026-09-09T20:54:26.207Z", "modified": "2026-09-14T13:42:35.435Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00644, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87011", "title": "Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout token. Each request repeated uncached network fetches, and the signing-key lookup blocked the async event loop, so requests carrying invalid tokens could stall the single-worker instance and amplify traffic to the identity provider when ENABLE_OAUTH_BACKCHANNEL_LOGOUT was enabled. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w", "https://github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59714", "noindex": false, "published": "2026-08-13T19:10:42.122Z", "modified": "2026-08-14T18:08:59.250Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "severity": "high", "epss": 0.00478, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59714", "title": "Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This issue is fixed in version 0.10.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-x2ff-v5v8-m75m", "https://github.com/open-webui/open-webui/pull/26385", "https://github.com/open-webui/open-webui/commit/ac3449cac91e62b08a7c28e54fcd044d14dea791"], "fixes": ["0.10.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70494", "noindex": false, "published": "2026-08-04T20:58:05.325Z", "modified": "2026-08-05T13:59:11.639Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.00548, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70494", "title": "Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The cascade following the authorization check is bound to the folder owner's id, but the subfolder check accepted any inherited write grant instead of requiring ownership or administrator status. A collaborator can destroy the owner's subtree or force-move chats out of it when delete_contents=false. This issue is fixed in 0", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-3cg5-48j3-v4gv", "https://github.com/open-webui/open-webui/pull/27003", "https://github.com/open-webui/open-webui/commit/915ef7d0798d3175819cedbb2f62d7bf0db78c98"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}], "total": 161, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 9, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["0.11.0", "0.10.2", "0.10.1", "0.10.0", "0.9.6", "0.9.5", "0.9.4", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.12"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-15T14:35:40.830Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}