Vulnerabilidades en open-webui
173 resultadosCVE-2026-54020MEDIUMOpen WebUI: DNS Rebinding SSRF BypassEPSS 0.3%CVE-2025-65959HIGHOpen WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'EPSS 0.3%CVE-2026-109283MEDIUMOpen WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token ExchangeEPSS 0.3%CVE-2026-45385MEDIUMOpen WebUI: An IDOR vulnerability exists in the update_message_by_id API endpointEPSS 0.3%CVE-2026-109285LOWOpen WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File MetadataEPSS 0.2%CVE-2026-44563MEDIUMOpen WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/showEPSS 0.2%CVE-2026-45316LOWOpen WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)EPSS 0.2%CVE-2026-26192HIGHOpen WebUI vulnerable to Stored XSS via iFrame in citations modelEPSS 0.2%CVE-2026-26193HIGHOpen WebUI vulnerable to Stored XSS via iFrame embeds in response messagesEPSS 0.2%CVE-2026-54007HIGHOpen WebUI: Cross-origin postMessage confirmation bypass via action:submitEPSS 0.2%CVE-2026-45349HIGHOpen WebUI: Broken Access Control for Completions APIEPSS 0.2%CVE-2026-44567HIGHOpen WebUI: Open WebUI Improper Authorization ControlEPSS 0.2%CVE-2026-45345MEDIUMOpen WebUI: Missing authorization check at the model update function - models from other users can be updatedEPSS 0.2%CVE-2026-45303HIGHOpen WebUI: Stored XSS via the HTML renedering viewEPSS 0.2%CVE-2026-44557MEDIUMOpen WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-CollectionEPSS 0.2%CVE-2026-44559MEDIUMOpen WebUI: Missing Access Check on Channel Members Endpoint for Standard ChannelsEPSS 0.2%CVE-2026-45387MEDIUMOpen WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)EPSS 0.2%CVE-2026-44564MEDIUMOpen WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IOEPSS 0.2%CVE-2026-45314HIGHOpen WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/imageEPSS 0.2%CVE-2026-109289MEDIUMOpen WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocketEPSS 0.2%