Open WebUI vulnerabilities

Name: Open WebUI
Author: Open WebUI

Product: Open WebUI
Vendor: Open WebUI
Kind: Chat interface

Securaity has published 137 advisories for Open WebUI: 6 Critical, 53 High, 76 Medium, 2 Low.

Open WebUI is a chat interface: a web page where people can type messages and talk with AI models. It is often connected to models that the organization itself chooses. The software is made and maintained by Open WebUI, which shares its name with the product. It is typically installed and run by IT staff, developers or enthusiasts who want a chat screen for the AI models they choose to use.

RSS feed for Open WebUI

Advisories

2026-10-27 // 17:46 UTC Medium SA-26-623

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-622

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-620

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-619

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-618

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-617

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-616

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-615

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-614

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-613

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-612

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-611

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-610

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-609

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-608

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-607

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-606

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-605

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-447

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-446

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-445

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-444

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-443

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-442

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-441

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-440

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-439

Open WebUI: DNS Rebinding SSRF Bypass

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-438

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-437

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-436

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-435

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-434

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-433

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-432

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-431

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-393

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Critical SA-26-335

Open WebUI: Open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Critical SA-26-334

Open WebUI: Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-326

Open WebUI: open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-325

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-324

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-323

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-322

Open WebUI: Arena task endpoints can bypass underlying model access controls

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-321

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-320

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-319

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-318

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-317

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-316

Open WebUI: Account enumeration via observable login timing discrepancy

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-315

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users…

Affects: Open WebUI

Advisories

Sources