Vulnerabilities in open-webui
173 resultsCVE-2026-44560MEDIUMOpen WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector SearchEPSS 0.4%CVE-2026-59715LOWOpen WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)EPSS 0.4%CVE-2026-109293HIGHOpen WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export EndpointEPSS 0.4%CVE-2026-54014MEDIUMOpen WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webuiEPSS 0.4%CVE-2026-87999HIGHOpen WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetchEPSS 0.4%CVE-2026-87996HIGHOpen WebUI: SSRF into internal services via DNS rebinding in the Playwright web loaderEPSS 0.4%CVE-2026-45675HIGHOpen WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin AccountsEPSS 0.4%CVE-2026-70485HIGHOpen WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLsEPSS 0.4%CVE-2026-54022MEDIUMOpen WebUI: Any authenticated user can read other users' private notes via Socket.IOEPSS 0.3%CVE-2026-45402HIGHOpen WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach EndpointsEPSS 0.3%CVE-2026-70480MEDIUMOpen WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart renderingEPSS 0.3%CVE-2026-45667MEDIUMOpen WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)EPSS 0.3%CVE-2026-54011HIGHOpen WebUI: Stored XSS in Mermaid Markdown PreviewEPSS 0.3%CVE-2026-44566HIGHOpen WebUI: Arbitrary File Upload and Path TraversalEPSS 0.3%CVE-2026-109296MEDIUMOpen WebUI before 0.11.4 Missing Authorization via Backend Index on Model RoutesEPSS 0.3%CVE-2026-45665HIGHOpen WebUI: Stored XSS in Banner Component via Improper Sanitization OrderEPSS 0.3%CVE-2026-45398HIGHOpen WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access ControlsEPSS 0.3%CVE-2026-109295MEDIUMOpen WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event LoopEPSS 0.3%CVE-2026-54008HIGHOpen WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`EPSS 0.3%CVE-2026-54012HIGHOpen WebUI: Forged model meta.knowledge allows cross-user file read and deletionEPSS 0.3%