Securaity Browse advisories
SA-26-321 High

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id…

Open WebUI

More for Open WebUI RSS feed for Open WebUI

Severity
High, CVSS 8.0
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Record
CVE-2026-59224
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
July 9, 2026
Source last modified
July 24, 2026

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbound identity claim. This issue is fixed in version 0.10.0.

Description quoted from the NVD record.

Who is affected

Open WebUI is a self-hosted chat interface that your organization runs on its own server to use AI models. This flaw affects all versions before 0.10.0 and is in the part that connects users to the terminal feature. Because of how that part passes along who the user is, a person could trick the terminal service into treating them as a different user, and the user identity it forwards can be faked. This could let someone act as another person in the terminal feature. This flaw is rated High.

What to do

  1. The person who installed or runs Open WebUI for your organization should check which version is in use.
  2. If it is older than 0.10.0, update Open WebUI to version 0.10.0 or later, which fixes this flaw.
  3. If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to 0.10.0 will be done.
  4. After the update, have whoever runs it check that the version shown is 0.10.0 or later.

Analysis written from the source record as of July 24, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all