SurrealDB versions before 3.3.0 contain an access control vulnerability where the system does not properly verify the caller-selected namespace or database against the authenticated user's permission level. This flaw allows an authenticated attacker to access and manipulate data across tenant boundaries if table permissions permit.
SurrealDB versions from 3.0.0 up to but not including 3.3.0 have an information disclosure vulnerability. This flaw allows users with record access to read data that should be hidden by field-level SELECT permissions via COMPUTED fields. Attackers can exploit this by selecting records with readable COMPUTED fields derived from hidden fields or by using write RETURN clauses with $before/$after to reveal concealed values. The vulnerability has a CVSS score of 6.5, indicating a high severity level.
SurrealDB versions prior to 3.3.0 have a denial of service vulnerability that can be triggered by query-capable users reading non-ASCII header values in embedded JavaScript. This can cause the server process to abort when such headers are accessed via certain JavaScript methods or returned from fetch endpoints.
Open WebUI versions from 0.6.31 up to but not including 0.11.4 contain a stored cross-site scripting (XSS) vulnerability in the Markdown renderer. This vulnerability arises because user-authored tool-call detail blocks are treated as tool output and their embeds attribute is mounted in script-enabled iframes. Authenticated users can exploit this by posting crafted messages or citation content that execute JavaScript in other users' browsers, potentially enabling in-app phishing or session hijacking if iframeSandboxAllowSameOrigin is enabled.
Open WebUI versions prior to 0.11.4 have a missing authorization vulnerability that allows authenticated users to access disabled model provider backends by specifying an explicit backend index. This can be done via path segments or query parameters on Ollama and OpenAI-compatible listing routes, potentially exposing API keys, version strings, and connection enumerations.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated users can exploit this by providing crafted file search patterns that cause catastrophic backtracking in regex processing, stalling server workers and blocking the event loop for approximately two seconds per repeated call. This vulnerability impacts availability but does not affect confidentiality or integrity.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain a denial of service vulnerability in the automation recurrence-rule validator. This vulnerability arises because the validator's sub-daily frequency guard parses rule text more strictly than the calendar library that executes it, allowing crafted rules to expand per second and block the shared event loop for minutes. The issue affects users permitted to create automations who can submit specially crafted recurrence rules that cause synchronous blocking on every scheduler poll.
Open WebUI versions from 0.6.42 up to but not including 0.11.4 contain a vulnerability where authenticated users can cause uncontrolled resource consumption. By supplying compressed remote image URLs in chat messages, attackers can trigger unbounded decompression of gzip-encoded responses, exhausting server memory and causing denial of service.
Open WebUI versions from 0.9.0 up to but not including 0.11.4 contain a denial of service vulnerability. Authenticated users with automations permission can submit unsatisfiable recurrence rules, such as February 30th, to the automations create or update endpoints. This causes the instance to stall by blocking the shared event loop for several seconds per request, resulting in denial of service.
Open WebUI versions 0.11.0 through before 0.11.4 contain a vulnerability where user-supplied grep patterns are compiled using a regex engine that can expand nested counted repetitions unboundedly at compile time. Authenticated users can exploit this by submitting short nested repetition patterns that cause the event loop to block and exhaust worker memory, leading to denial of service.
Open WebUI versions from 0.11.1 up to but not including 0.11.4 contain a stored cross-site scripting (XSS) vulnerability in the DocxPreview.svelte component. This flaw allows authenticated users to execute arbitrary scripts by uploading specially crafted DOCX files. Exploitation can lead to theft of a previewing administrator's session token from local storage, enabling instance takeover.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain an information disclosure vulnerability. Authenticated non-admin users with tool export permission can exploit this flaw to retrieve the full Python source code of read-only shared tools via a specific API endpoint. This exposure can reveal embedded API keys and credentials, potentially compromising sensitive information.
Open WebUI versions from 0.6.27 up to but not including 0.11.4 contain an information disclosure vulnerability that allows destination servers to obtain user session cookies during OAuth-mode connections. This vulnerability enables operators of OpenAI-compatible connections, OpenAPI tool servers, or terminal servers to capture and replay session cookies, potentially hijacking user accounts including those with administrative privileges.
Open WebUI versions before 0.11.4 have a stored cross-site scripting (XSS) vulnerability in the MarkdownInlineTokens.svelte component. This flaw allows authenticated users to inject javascript: links into markdown-rendered chat messages. When other users click these malicious links, their JSON Web Tokens (JWTs) stored in local storage can be stolen, including those of administrators.
Open WebUI versions from 0.6.33 up to but not including 0.11.4 contain a cross-site scripting (XSS) vulnerability. This flaw allows authenticated users to inject malicious scripts via the citation embed_url fields. When a victim clicks a crafted chat citation, the script executes in their session, potentially exposing sensitive tokens and enabling attacker impersonation.
Open WebUI versions from 0.9.6 up to but not including 0.11.4 contain an authorization flaw in the knowledge base file listing functionality. This flaw allows users with read access to any knowledge base to supply a directory_id that belongs to a different knowledge base, bypassing proper verification. As a result, the API endpoint GET /api/v1/knowledge/{id}/files returns breadcrumb information exposing folder names, owner user IDs, and knowledge base IDs for the supplied directory and its ancestor directories.
Open WebUI versions from 0.8.8 up to but not including 0.11.4 have an improper authorization vulnerability. This flaw allows users who have been deactivated to continue executing terminal commands via an already open terminal WebSocket connection. The vulnerability exists because the terminal proxy route only verifies access on the first message, enabling continued unauthorized command execution and file access.
Open WebUI versions from 0.7.0 up to but not including 0.11.4 have a cross-origin message handling vulnerability in the SyncStatsModal component. This flaw allows any website to steal a signed-in user's session token by sending unvalidated verify:chat messages. The vulnerability involves a path-traversal chat ID that redirects an authenticated stats export request to the authentication endpoint, exposing the victim's JWT token and enabling full API access.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 have an improper authorization vulnerability in the chat fork handler. This flaw allows shared folder members who have been downgraded to read-only access to fork chats they originally created while having write access, placing attacker-controlled chats in the source chat's folder without verifying folder write permissions. This can lead to unauthorized insertion of chats visible to folder owners and members.
Open WebUI versions from 0.6.0 up to but not including 0.11.4 have an improper access control vulnerability in the has_access_to_file function. This flaw allows former knowledge base collaborators to retain access to files through stale cached references, enabling attackers with read or write permissions to download or delete files, including those in private knowledge bases.