open-webui vulnerabilities (PyPI)
161 vulnerabilities.
-
open-webuiPyPI Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange 6.5 Medium -
open-webuiPyPI Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange 6.5 Medium -
open-webuiPyPI Open WebUI: Any authenticated user can hang the server via a cyclic chat message history 6.5 Medium -
open-webuiPyPI Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets 5.0 Medium -
open-webuiPyPI Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree 6.5 Medium -
open-webuiPyPI Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch 7.1 High -
open-webuiPyPI Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion 7.1 High -
open-webuiPyPI Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions 4.3 Medium -
open-webuiPyPI Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader 7.7 High -
open-webuiPyPI Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin 8.7 High -
open-webuiPyPI Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint 4.3 Medium -
open-webuiPyPI Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends 4.3 Medium -
open-webuiPyPI Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite 8.1 High -
open-webuiPyPI Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication 6.8 Medium -
open-webuiPyPI Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes 6.5 Medium -
open-webuiPyPI Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle 4.3 Medium -
open-webuiPyPI Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value 4.3 Medium -
open-webuiPyPI Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout 7.5 High -
open-webuiPyPI Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder 8.1 High -
open-webuiPyPI Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically 6.5 Medium -
open-webuiPyPI Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages 8.7 High -
open-webuiPyPI Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints 6.5 Medium -
open-webuiPyPI Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check 6.3 Medium -
open-webuiPyPI Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing 6.5 Medium -
open-webuiPyPI Open WebUI: DNS Rebinding SSRF Bypass 6.3 Medium -
open-webuiPyPI Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup 4.3 Medium -
open-webuiPyPI Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata 5.3 Medium -
open-webuiPyPI Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin 8.2 High -
open-webuiPyPI Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs 7.1 High -
open-webuiPyPI Open WebUI: Users denied the image-generation permission can still generate images via chat completions 4.3 Medium -
open-webuiPyPI Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint 3.1 Low -
open-webuiPyPI Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client 8.1 High -
open-webuiPyPI Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages 5.4 Medium -
open-webuiPyPI Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering 4.1 Medium -
open-webuiPyPI Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader 7.7 High -
open-webuiPyPI Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids) 7.1 High -
open-webuiPyPI open-webui terminal proxy path traversal guard bypass via 9x encoded traversal 7.7 High -
open-webuiPyPI Open WebUI: Arena task endpoints can bypass underlying model access controls 5.4 Medium -
open-webuiPyPI Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) 8.0 High -
open-webuiPyPI Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete 5.4 Medium -
open-webuiPyPI Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching 4.3 Medium -
open-webuiPyPI Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials 6.0 Medium -
open-webuiPyPI Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding 3.1 Low -
open-webuiPyPI Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse) 3.5 Low -
open-webuiPyPI Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB) 4.3 Medium -
open-webuiPyPI Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id 7.7 High -
open-webuiPyPI Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout 7.1 High -
open-webuiPyPI Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave) 3.1 Low -
open-webuiPyPI Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config 6.5 Medium -
open-webuiPyPI Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation 3.1 Low - Show olderLoading…