Vulnerabilidades en open-webui

154 resultados
Análisis Vexday

O volume de CVEs catalogadas para o Open-WebUI apresenta crescimento expressivo, com 77 das 115 vulnerabilidades registradas surgindo nos últimos 90 dias — sinal de que o produto está sob escrutínio crescente da comunidade de pesquisa de segurança. Nenhuma vulnerabilidade consta atualmente no catálogo KEV da CISA, o que coloca a taxa de exploração ativa abaixo da média geral do catálogo, embora isso não elimine o risco dado o número relevante de entradas recentes. O tipo de falha mais comum, CWE-862 (ausência de verificação de autorização), aponta para deficiências estruturais nos controles de acesso que merecem atenção prioritária em ambientes expostos. A CVE mais perigosa identificada atualmente é CVE-2024-7959, com escore EPSS de 0,2446, acompanhada de PoC pública disponível — condição que eleva concretamente a probabilidade de exploração e deve orientar a priorização de remediação.

CVE-2026-59222MEDIUMOpen WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentialsEPSS 0.3%CVE-2026-44549HIGHOpen WebUI: Stored XSS in excel file previewEPSS 0.3%CVE-2026-45339MEDIUMOpen WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpointsEPSS 0.3%CVE-2026-59216HIGHOpen WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_idEPSS 0.3%CVE-2026-44721HIGHOpen WebUI: Stored XSS via Model DescriptionEPSS 0.3%CVE-2026-70486HIGHOpen WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originEPSS 0.3%CVE-2026-45396MEDIUMOpen WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data ManipulationEPSS 0.3%CVE-2026-44556HIGHOpen WebUI: responses passthrough endpoint lacks access control authorizationEPSS 0.3%CVE-2026-44552HIGHOpen WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache PoisoningEPSS 0.3%CVE-2026-44555HIGHOpen WebUI: Base Model Routing Bypasses Access Control via Model ChainingEPSS 0.3%CVE-2026-54016MEDIUMOpen WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File EnumerationEPSS 0.3%CVE-2026-59226LOWOpen WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocationEPSS 0.3%CVE-2026-45401HIGHOpen WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load EndpointsEPSS 0.3%CVE-2026-54013HIGHOpen WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUIEPSS 0.3%CVE-2026-70483LOWOpen WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpointEPSS 0.3%CVE-2026-54006MEDIUMOpen WebUI: Calendar event re-parenting allows writing events into another user's calendarEPSS 0.3%CVE-2026-59213LOWOpen WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)EPSS 0.3%CVE-2026-70494HIGHOpen WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolderEPSS 0.3%CVE-2026-70481MEDIUMOpen WebUI: Any member with write access to a standard channel can edit or delete other members' messagesEPSS 0.3%CVE-2026-44554HIGHOpen WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection OverwriteEPSS 0.3%