open-webui@0.4.8

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the process of hostname resolution and subsequent HTTP connection. An attacker can access internal network resources and sensitive metadata by submitting a specially crafted URL and controlling the authoritative DNS server to alternate responses between the initial validation and the actual connection. This may result in the server disclosing internal information, including cloud instance credentials or OAuth tokens, to the attacker. This is only exploitable if the attacker has an account on the instance and controls the authoritative DNS for a submitted hostname, and, for the OAuth path, if OAuth login is configured with a user-influenced picture claim.

Upgrade open-webui to version 0.11.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to User Impersonation via the ws_terminal process. An attacker can gain unauthorized access to another user's terminal session by injecting crafted values into the session_id parameter, causing the backend to resolve the attacker's chosen user identity. This can be exploited by an authenticated user through manipulation of WebSocket requests or by leveraging trust in the X-User-Id header on the HTTP path.

Upgrade open-webui to version 0.10.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the Pyodide code execution process. An attacker can execute arbitrary server-side code and perform authenticated actions as another user by storing a malicious payload in a shared chat and tricking a victim into clicking the Run button. This is only exploitable if the victim has administrative privileges or holds workspace.functions or workspace.tools permissions, and if Pyodide code execution is enabled.

Upgrade open-webui to version 0.10.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Protection Mechanism Failure through improper matching of hostnames in the WEB_FETCH_FILTER_LIST process. An attacker can access hosts that should be blocked or bypass allowlists by crafting URLs with specific paths or subdomains.

Upgrade open-webui to version 0.10.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Timing Attack via the signin process. An attacker can determine whether specific email addresses are registered by measuring the response time of authentication attempts.

Upgrade open-webui to version 0.10.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the get_messages_by_parent_id process. An attacker can access the content, channel ID, and author metadata of messages in private channels they do not belong to by supplying a known message ID as the thread root in a channel they can access.

Upgrade open-webui to version 0.10.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization through the get_event_call process. An attacker can execute arbitrary code and tools in another user's authenticated session by supplying a victim's session_id and leveraging the lack of ownership validation. This enables full session compromise, allowing the attacker to act with the victim's identity and privileges, including potential remote code execution on the server if the victim is an administrator. This is only exploitable if the attacker has a valid user account, the code interpreter is enabled, a shared note exists between attacker and victim, and the victim is online and opens the shared note.

Upgrade open-webui to version 0.10.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the process_uploaded_file process. An attacker can modify the file membership of a knowledge base without proper authorization by supplying a crafted metadata.knowledge_id value during file upload, which results in unauthorized files being associated with the target knowledge base and accessible to its readers and owners. This is only exploitable if the attacker has a verified account with read access to the target knowledge base and knows its identifier.

Upgrade open-webui to version 0.10.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the rendering of chat messages containing certain HTML tags using the @html functionality in Svelte. An attacker can execute arbitrary JavaScript in the context of a user's browser by injecting malicious payloads into chat transcripts, potentially stealing access tokens and gaining full control over user accounts. If the compromised account belongs to an admin, the attacker can escalate to remote code execution on the backend server by creating a malicious function. This is only exploitable if a user opens a malicious chat transcript or if "Enable Community Sharing" is enabled, allowing the payload to propagate to other users.

Upgrade open-webui to version 0.6.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the load_url_image function, which performs a GET request on user-supplied URLs without restricting the domain. An attacker can access internal network resources and perform port scanning by submitting crafted URLs, potentially inferring open ports and interacting with internal services if accessible.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the CitationModal process. An attacker can execute arbitrary JavaScript in the context of another user's session by crafting a malicious document payload and manipulating the html property within document metadata, which is then rendered in an iFrame when the citation is previewed or shared. This is only exploitable if the victim expands the sources and clicks the document containing the payload.

Upgrade open-webui to version 0.7.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the embeds property of response messages, which is loaded into an iFrame with an insufficiently restrictive sandbox. An attacker can execute arbitrary JavaScript in the context of another user's session by crafting a malicious chat history and sharing a link containing the payload. This can lead to session hijacking or exposure of sensitive information such as authentication tokens.

Upgrade open-webui to version 0.7.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the file upload process. An attacker can execute arbitrary JavaScript code in the context of another user's browser by uploading a crafted HTML file and convincing an admin or the uploading user to view the file through a specific endpoint. This is only exploitable if an admin or the uploading user accesses the malicious file via the provided link.

Upgrade open-webui to version 0.6.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the ydoc:document:join process. An attacker can access private note contents belonging to other users by joining a document room using an alternate document ID format that bypasses the intended authorization check, thereby retrieving sensitive data without proper access rights.

Upgrade open-webui to version 0.8.11 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization through the get_ollama_url process. An attacker can gain unauthorized access to restricted backend resources by supplying a crafted url_idx path parameter to route requests to internal or disabled backends, which are authenticated using the backend's configured API key.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the path parameter in the terminal server proxy route. An attacker can access sensitive files and internal endpoints by supplying specially crafted, double-encoded traversal sequences that bypass input sanitization and escape the intended directory or policy scope.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the validate_url process. An attacker can access internal network resources and sensitive information by supplying a URL that redirects to internal addresses, bypassing the initial validation. This is only exploitable if the Playwright engine is used and the environment variable ENABLE_RAG_LOCAL_WEB_FETCH is set to False.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the resource_id processing in Milvus multitenancy mode. An attacker can access private knowledge-base content belonging to other users by crafting a malicious collection name that bypasses access control checks and is interpolated unsafely into a database expression. This is only exploitable if Milvus multitenancy mode is enabled in the deployment.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Protection Mechanism Failure via the profile_image_url field in the model metadata process. An attacker can execute arbitrary JavaScript in the context of another user's session by storing a crafted SVG payload as a model's profile image and enticing a victim to open the image URL as a top-level document. This enables theft of authentication tokens and full account compromise. This is only exploitable if a victim user opens the model profile image URL directly in a new browser tab or window.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the update_event_by_id process. An attacker can inject unauthorized events into another user's calendar by supplying a known calendar_id as the destination, bypassing intended access controls.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Directory Traversal in the serve_cache_file function when validating file paths using an incomplete containment check that does not append a path separator. An attacker can access files in sibling directories whose names start with "cache" by sending crafted requests to the /cache/{path} endpoint. This is only exploitable if the attacker is an authenticated user and targets sibling directories with names beginning with "cache". Client-side path normalization must be bypassed by using raw HTTP or ASGI requests.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the handling of prompt history operations, including compute_diff, update_prompt_version, and delete_history_entry. An attacker can access or delete another user's private prompt history entries by supplying known victim history IDs to these endpoints after authenticating with their own prompt. This allows unauthorized reading of sensitive prompt snapshots and deletion of version history entries belonging to other users.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the get_image_base64_from_url function. An attacker can access files belonging to other users by supplying a file identifier in the image_url.url field that does not begin with 'http://', 'https://', or 'data:image/'. The server reads the referenced file from disk without verifying ownership, encodes it, and returns the content to the requesting user. This allows unauthorized disclosure of sensitive file contents through crafted API requests.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Origin Validation Error through the postMessage process. An attacker can execute unauthorized actions and trigger backend API calls under the victim's authenticated session by sending crafted cross-origin messages to the chat interface. This is only exploitable if the victim is authenticated in the browser with a valid session token.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization through the improper validation of the meta.knowledge field during model creation, update, or import processes. An attacker can gain unauthorized access to and delete files belonging to other users by forging file IDs in the meta.knowledge metadata and leveraging built-in tools such as view_file. This is only exploitable if the attacker has permissions to create, update, or import workspace models and knows the victim's file ID.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the Markdown file preview process when rendering Mermaid blocks with a permissive security configuration. An attacker can execute arbitrary JavaScript in the context of the victim's browser by uploading and previewing a malicious Markdown file containing crafted Mermaid content.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the search_knowledge_files function when native function calling is enabled and the selected model has no attached knowledge bases. An attacker can retrieve metadata for files from private or restricted knowledge bases by supplying an arbitrary knowledge_id without proper authorization checks. This is only exploitable if the attacker is authenticated, knows the target knowledge_id, the selected model has no attached knowledge bases, builtin tools are enabled, the knowledge builtin tool category is enabled, and native function calling is enabled.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization through the improper authorization checks in the insert_chat_files process. An attacker can gain unauthorized access to and delete files belonging to other users by attaching arbitrary file identifiers to their own chat messages and leveraging shared chat associations.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the _process_picture_url function. An attacker can access internal network resources and exfiltrate sensitive data by submitting a crafted OAuth profile image URL that redirects to internal addresses. This is only exploitable if the attacker has a valid identity on the configured OAuth IdP and either ENABLE_OAUTH_SIGNUP or OAUTH_UPDATE_PICTURE_ON_LOGIN is enabled.

Upgrade open-webui to version 0.9.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the HTML rendering view. An attacker can execute arbitrary HTML or JavaScript in the user's context by injecting malicious scripts into embedded file in the chat that later shared with another user.

Upgrade open-webui to version 0.6.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to the missing MIME-type validation of profile_image_url field. An attacker can execute arbitrary HTML or JavaScript in the context of user's browser by injecting malicious HTML or JavaScript into input fields that are rendered without proper output encoding.

Upgrade open-webui to version 0.8.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the get_folders and process_chat_payload paths in the folder and chat handling code. An attacker can read files and knowledge collections they do not have access to by attaching them to a folder or causing chat processing to consume folder-backed RAG context, thereby exposing restricted content to the requester. The same issue also allows a user to add unreadable files to knowledge bases via the knowledge upload endpoints, causing private file contents to be ingested and surfaced through chat and retrieval features.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the validate_url function in the URL parsing and request-routing path. An attacker can reach internal or loopback targets by supplying a URL containing a backslash, tab, carriage return, or line feed, causing urllib.parse.urlparse and the HTTP client to interpret the host differently. This lets a URL pass host-based filtering while the outbound request is sent to a different destination, exposing internal services and defeating private-IP allowlists.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the get_user_profile_image_by_id and get_model_profile_image handlers in the profile image endpoints. An attacker can supply an external http(s) profile image URL, causing the application to issue a 302 redirect to an attacker-controlled origin, exposing the victim’s IP address, user agent, and referrer when the image is fetched.

Upgrade open-webui to version 0.9.3 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the FeedbackForm and insert_new_feedback paths in backend/open_webui/models/feedbacks.py. An attacker can forge feedback attribution by sending a POST /api/v1/evaluations/feedback request with client-supplied user_id, id, or version fields that are accepted into the form and then written into the new record. This lets a regular authenticated user submit feedback on behalf of another user, corrupting the evaluation leaderboard and causing admin feedback exports and listings to show spoofed ownership.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through get_content_from_url in retrieval/utils.py, SafeWebBaseLoader in web/base.py, and image_edits in routers/images.py. An attacker can cause the server to fetch internal services or cloud metadata by providing a public URL that returns a 3xx redirect to a private address. The redirected response is then returned to the attacker, exposing internal resources such as RFC1918 hosts, loopback services, and 169.254.169.254 metadata endpoints.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the validate_url function in the URL validation component. An attacker can bypass private-address checks by supplying a hostname that resolves to a private IPv6 address, causing the loader to accept URLs that point at loopback, link-local, or other non-public targets.

Notes

• The vulnerable check runs on every code path that calls validate_url(), so the same SSRF bypass applies beyond the web-search flow the advisory highlights; the maintainer note names /api/v1/retrieval/process/web and /api/v1/images/edit as examples of callers.
• The bypass is broader than plain private IPv6: IPv4-mapped IPv6 literals and several non-global IPv4 ranges also slip past the validator-based filtering, so deployments that only expected to block RFC1918 space can still be exposed to metadata, loopback, and other reserved targets.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the {@html svg} rendering path in the SVGPanZoom.svelte common component. An attacker can execute an arbitrary script in the browser by supplying a crafted SVG payload that is rendered without sanitization. This allows an attacker to run JavaScript in the user’s session, exposing page data and enabling actions within the victim’s browser context.

Upgrade open-webui to version 0.6.31 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization through the update_tools_by_id handler in routers/tools.py. An attacker can execute arbitrary Python code on the server by sending a tool update that modifies the tool's content after obtaining a write grant on the tool, even without the workspace permissions normally required to submit executable tool code. The vulnerable path accepts content overwrites for existing tools and passes the updated source into load_tool_module_by_id, where it is imported with exec(content, module.__dict__). In deployments where the worker runs with elevated privileges, this lets a collaborator with only per-tool write access run attacker-controlled code as the server user and potentially exfiltrate data or take over the container.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the authentication process when API keys are supplied via the x-api-key header instead of the Authorization header. An attacker can gain unauthorized access to restricted API endpoints by sending requests with the x-api-key header, thereby bypassing endpoint restrictions intended by the operator.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Improper Authorization via the bypass_filter parameter in the HTTP query string, which is unintentionally exposed in the route handler. An attacker can gain unauthorized access to restricted models by appending ?bypass_filter=true to requests, thereby skipping access control checks and invoking admin-restricted models using the server's API keys.

Upgrade open-webui to version 0.8.11 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization via the /api/v1/memories/ef endpoint. An attacker can trigger embedding generation and consume computational resources or incur costs by making unauthenticated requests to this endpoint.

Upgrade open-webui to version 0.8.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the GET /api/tasks and POST /api/tasks/stop/{task_id} endpoints, which lack proper ownership checks. An attacker can enumerate and terminate background tasks belonging to other users by sending authenticated requests to these endpoints. This can result in widespread disruption of ongoing processes for all users in a multi-user environment.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization through the /api/v1/utils/code/execute endpoint, which fails to enforce the ENABLE_CODE_EXECUTION configuration flag. An attacker can execute arbitrary Python code within the Jupyter container and access internal network services by sending crafted requests to the affected endpoint. This is only exploitable if the attacker is an authenticated user and the Jupyter server is connected.

Upgrade open-webui to version 0.8.12 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the has_access_to_file process. An attacker can permanently delete files owned by other users, as well as read or modify their contents, by leveraging access to file UUIDs obtained through shared knowledge bases and exploiting insufficient authorization checks in shared chat scenarios. This is only exploitable if the target file is referenced in any shared chat and the attacker has a valid authenticated account.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the chat_completion process. An attacker can access and continue another user's conversation by supplying a known Chat ID in API requests. This is only exploitable if both users have access to the same model and the attacker knows the target user's Chat ID.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Reliance on File Name or Extension of Externally-Supplied File via the audio transcription upload process. An attacker can execute arbitrary JavaScript in the context of another user's session by uploading a specially crafted file with a malicious extension and tricking a victim into accessing the resulting URL. This can lead to theft of session tokens and full account takeover. This is only exploitable if the chat.stt permission is enabled for the attacker.

Upgrade open-webui to version 0.9.3 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the rendering of user-uploaded Office files as HTML using the Svelte {@html} directive without proper sanitization. An attacker can execute arbitrary JavaScript in the context of other users by uploading a specially crafted Office document containing malicious HTML or scripts, which will be rendered and executed when previewed by any user.

Upgrade open-webui to version 0.9.3 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the pdf generate process. An attacker can cause the server to initiate arbitrary outbound HTTP requests by injecting crafted HTML, such as an <img> tag, into user-controllable fields that are rendered into the PDF export. This can be exploited to enumerate internal assets or trigger requests to external systems.

Upgrade open-webui to version 0.5.11 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper sanitization order in the Banner component. An attacker can execute arbitrary JavaScript in the context of privileged users by injecting malicious payloads into the banner content, potentially leading to session token theft and privilege escalation. This is only exploitable if an attacker has administrator privileges to create or modify banners.

Upgrade open-webui to version 0.8.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the GET /api/v1/notes/{note_id} endpoint due to missing authorization checks. An attacker can access and retrieve notes belonging to other users by manipulating the note_id parameter and enabling the notes feature through the API, potentially exposing sensitive or private user data. This is only exploitable if the attacker is an authenticated user and can modify the enable_notes configuration via the API or frontend.

Upgrade open-webui to version 0.8.11 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the profile_image_url process. An attacker can execute arbitrary JavaScript in the context of another authenticated user's session by crafting a malicious SVG image as their OAuth profile picture and tricking a victim into visiting the profile image endpoint. This allows the attacker to exfiltrate sensitive data such as authentication tokens and potentially take over the victim's account. This is only exploitable if OAuth signup is enabled or OAuth login with picture sync is active, and the attacker can set their profile picture URL at the identity provider.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the pin_channel_message process. An attacker can modify the is_pinned, pinned_by, and pinned_at fields of messages by sending API requests with only read-level permissions.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the get_status function. An attacker can access sensitive configuration details by sending an unauthenticated HTTP GET request to the affected endpoint.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Improper Authorization in the model update process. An attacker can modify resources belonging to other users by sending crafted requests that bypass intended access controls.

Upgrade open-webui to version 0.5.7 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the profile_image_url parameter in the webhook creation or update process. An attacker can execute arbitrary JavaScript in the context of the application by supplying a crafted SVG payload containing malicious event handlers, which is then rendered without sanitization when the profile image URL is accessed in a browser. This is only exploitable if the channel feature is enabled and the victim is an authenticated, verified user.

Upgrade open-webui to version 0.9.3 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Race Condition through a race condition in the LDAP and OAuth authentication processes. An attacker can obtain administrative privileges by sending multiple concurrent authentication requests during the initial user registration phase, resulting in multiple users being assigned the admin role.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the retrieval process, specifically when validating access to knowledge base collections by UUID. An attacker can access, modify, or delete another user's private knowledge base by supplying a known UUID to the affected API endpoints. This is only exploitable if the attacker is an authenticated user and knows the target knowledge base UUID, which may be leaked through normal platform usage.

Upgrade open-webui to version 0.9.5 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization via the chat_completion API when user-supplied tool_ids or tool_servers parameters are processed without verifying the user's permissions. An attacker can gain unauthorized access to restricted server tools by supplying valid identifiers, resulting in actions being performed with server-level privileges.

Upgrade open-webui to version 0.8.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Information Exposure via the api/models endpoint. An attacker can access sensitive system prompt information by sending authenticated requests as a non-admin user.

Upgrade open-webui to version 0.8.9 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization via the pin_note_by_id process. An attacker can modify the is_pinned status of a shared note without proper authorization by sending a POST request to the relevant endpoint while only having read access. This is only exploitable if the attacker has been granted explicit read access to the note via sharing.

Upgrade open-webui to version 0.9.3 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Directory Traversal via the upload_model function. An attacker can overwrite or delete arbitrary files on the server by uploading files with specially crafted filenames containing directory traversal sequences.

Upgrade open-webui to version 0.6.10 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the memories API endpoints. An attacker can access, delete, restore, and view the contents of other users' data by sending crafted requests to endpoints such as POST /api/v1/memories/query, POST /api/v1/memories/{memory_id}/update, and DELETE /api/v1/memories/{memory_id}.

Upgrade open-webui to version 0.6.19 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the update_message_by_id and delete_message_by_id endpoints due to missing ownership validation for messages. An attacker can alter or remove messages belonging to other users by sending direct API requests with the message_id parameter, even if they only have read access to the channel.

Upgrade open-webui to version 0.6.19 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the update_message_by_id process. An attacker can modify messages authored by other users by sending a request to the message update endpoint with only read permissions in a standard channel. This is only exploitable if the attacker is an authenticated user, the target channel is a standard channel, access_control is set to None or allows read access, and the attacker can obtain the target message ID.

Upgrade open-webui to version 0.8.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the process that previews Excel file attachments using the sheet_to_html function. An attacker can execute arbitrary scripts in the context of the victim's browser by uploading a crafted XLSX file containing malicious payloads, which are then rendered unsanitized in the DOM when the preview feature is used. This is only exploitable if a user opens and previews the malicious file attachment in a chat.

Upgrade open-webui to version 0.8.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the rendering process of the pending user overlay content due to improper sanitization order. An attacker can execute arbitrary JavaScript in the browser context of affected users by injecting malicious Markdown containing links with javascript: URLs.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the is_user_channel_member function. An attacker can retain unauthorized read and write access to group or direct message channels by making direct API calls after being deactivated from the channel. This is only exploitable if the channels feature is enabled, the attacker has a valid user account, and the attacker was previously a member of the channel (and thus knows the channel ID).

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the get_sources_from_items process. An attacker can access unauthorized file and knowledge base content by supplying known file or knowledge base identifiers to the chat completion API, which are then used to query the vector store without proper authorization checks. This is only exploitable if the attacker has a valid user account and knows the file or knowledge base ID of a resource that has already been processed into the vector store.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Improper Authentication in the LdapForm process. An attacker can gain unauthorized access to any LDAP user account, including administrative accounts, by submitting a valid username with an empty password to the LDAP authentication endpoint. This results in the issuance of a full session token for the target user. This is only exploitable if LDAP authentication is enabled and the underlying LDAP server accepts unauthenticated simple binds with empty passwords, and the attacker knows a valid LDAP username.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization via the create_folder process. An attacker can create unauthorized folders in another user's account, potentially flooding the victim's folder tree or planting phishing content, by submitting crafted POST requests that include a victim's user ID. This is only exploitable if the attacker has an authenticated account with folder creation permissions and knows or can guess the victim's user UUID.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization through the import_models process. An attacker can overwrite existing models owned by other users, modify their configuration, and escalate access by submitting crafted payloads to the model import endpoint without ownership or access grant validation. This is only exploitable if the attacker has the workspace.models_import permission and knows the target model's ID.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the set_access_grants process. An attacker can override administrative access controls by submitting arbitrary access grants, including wildcard grants, which are persisted without proper filtering. This allows unauthorized users to make channels publicly accessible or grant access to individual users, even when such actions are restricted by administrative policy. This is only exploitable if the attacker has an account with permission to create group channels or owns an existing channel, and the administrator has configured restrictive sharing permissions for regular users.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the process_web and process_youtube endpoints when the overwrite parameter is set to true and the collection_name is attacker-controlled. An attacker can overwrite or delete another user's knowledge base content by sending crafted API requests with a known collection identifier. This is only exploitable if the attacker has a valid user account and knows the target collection name (KB UUID), which can be obtained through enumeration.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization via the _validate_collection_access function. An attacker can obtain sensitive metadata, such as IDs, names, and descriptions of all knowledge bases across users, by sending crafted API requests to the retrieval query endpoints.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the get_channel_members_by_id process. An attacker can retrieve the list of users, including their IDs, names, emails, roles, and profile images, associated with a private channel by making an authenticated API call to the affected endpoint if they possess the channel's UUID. This is only exploitable if the channels feature is enabled and the attacker knows the channel UUID.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the base_model_id process. An attacker can gain unauthorized access to restricted models by creating a new model that chains to a restricted base model and invoking it, causing the server to dispatch requests using privileged credentials. This is only exploitable if the attacker has model creation permissions and a restricted base model exists on the instance.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization through the /responses endpoint, which fails to enforce per-model access control. An attacker can interact with any configured model, including those restricted by administrators, by sending crafted POST requests with arbitrary model IDs. This can lead to resource exhaustion, bypass of cost-tier or group-based restrictions, and unauthorized access to sensitive or expensive models.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the SESSION_POOL process. An attacker can maintain unauthorized access to other users' notes and modify their content by keeping an active Socket.IO session after their administrative privileges have been revoked or their user account has been deleted. This is only exploitable if the attacker had an active Socket.IO connection established while holding admin privileges and continues to keep the session alive after demotion or deletion.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the generate_completion, embed, embeddings, and show_model_info functions. An attacker can access restricted model information and consume compute resources by sending crafted API requests to unprotected endpoints. This is only exploitable if Ollama is configured as a backend, model access control is enabled, and the attacker knows the restricted model name.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the handling of Redis cache keys for tool_servers and terminal_servers when multiple instances share a Redis backend. An attacker can overwrite or inject malicious tool server or terminal server configurations across instances by leveraging admin access on one instance, causing users on another instance to unknowingly interact with attacker-controlled servers and potentially exposing sensitive data, OAuth tokens, and conversation context. This is only exploitable if multiple instances share a single Redis backend and the attacker has admin access on one of the instances.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the ydoc:document:update handler. An attacker can inject, modify, or delete content in collaborative documents by emitting crafted Socket.IO events after joining a document room with read-only access. If a user with write access subsequently saves the document, the unauthorized changes are persisted. This is only exploitable if the attacker has a valid user account with read access to a shared note and the note is open for collaborative editing.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the sanitizeResponseContent process. An attacker can execute arbitrary JavaScript in the browser of another user by crafting a malicious model description containing a markdown link with a javascript: URI, which is rendered unsanitized in the chat UI. This can lead to theft of sensitive information such as access tokens when a victim clicks the malicious hyperlink.

Upgrade open-webui to version 0.9.0 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization in the Tool Valves endpoint. An attacker can obtain sensitive information, such as API keys for backend systems, by sending GET /api/v1/tools/id/<tool_id>/valves requests using a low-privileged account and a known or easily guessed tool ID.

Upgrade open-webui to version 0.8.11 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authorization due to missing validation in the remove_file_from_knowledge_by_id function. An attacker can delete arbitrary files from other users' knowledge bases by providing the file ID, even if the file does not belong to their own knowledge base.

Upgrade open-webui to version 0.8.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the query_collection_handler function. An attacker can access other users' private documents, metadata, and personal memories by submitting crafted requests to the /api/v1/retrieval/query/collection endpoint using predictable collection names and user or file UUIDs.

Note: This is only exploitable if the Memory experimental feature is enabled for accessing personal memories.

Upgrade open-webui to version 0.8.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Information Exposure via the POST /api/v1/audio/transcriptions endpoint. An attacker can obtain sensitive server filesystem path information by submitting a crafted multipart request with a malicious filename value, causing the server to return error messages containing absolute paths in the HTTP response.

Upgrade open-webui to version 0.8.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the process_files_batch endpoint lacking proper ownership verification. An attacker can overwrite files belonging to other users and manipulate the content served to downstream processes by submitting crafted requests with file UUIDs obtained from accessible knowledge bases. This can result in unauthorized modification of data, silent data corruption, and the injection of attacker-controlled content into responses provided to other users.

Upgrade open-webui to version 0.8.6 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Access Control Bypass via the /api/tasks/stop/{task_id} endpoint. An attacker can enumerate tasks running by other users and use task_id to terminate any tasks running on the server.

Upgrade open-webui to version 0.8.11 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the /api/v1/retrieval/process/web endpoint . An attacker can access internal network resources, cloud metadata endpoints, and sensitive information by submitting crafted URLs to the affected API endpoint.

Upgrade open-webui to version 0.6.37 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the downloadPdf() function for Notes feature. An attacker can execute arbitrary JavaScript code and steal session tokens by importing a specially crafted Markdown file containing malicious <svg> or <script> HTML tags, which are rendered without proper sanitization when a user downloads the note as a PDF.

Upgrade open-webui to version 0.6.37 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Denial of Service (DoS) via the endpoint for converting markdown. An attacker can cause the server to spend excessive time on processing, rendering it unresponsive to other requests until the conversion is complete.

Upgrade open-webui to version 0.5.13 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Missing Authentication for Critical Function through the api/v1/utils/pdf endpoint. An attacker can exhaust server resources and cause a denial of service by sending a POST request with an excessively large payload. Additionally, unauthorized users can generate PDFs without proper verification, leading to misuse of the service and potential operational and financial impacts.

Upgrade open-webui to version 0.5.13 or higher.

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the chat file upload functionality. An attacker can inject malicious scripts or content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser leading to potential user data theft, session hijacking, malware distribution, and phishing attacks.

Upgrade open-webui to version 0.6.41 or higher.