open-webui vulnerabilities and threats

Open WebUI versions prior to 0.6.19 contain an authorization bypass vulnerability in the memories API. This flaw allows non-admin users to view, delete, and restore other users' memory data without proper authorization. The issue arises from inconsistent access controls on endpoints such as POST /api/v1/memories/query, POST /api/v1/memories/{memory_id}/update, and DELETE /api/v1/memories/{memory_id}. The vulnerability is fixed in version 0.6.19.

CVE-2026-44569 is an Insecure Direct Object Reference (IDOR) vulnerability in open-webui versions prior to 0.6.19. Authenticated users with read access to a channel can modify or delete any message within that channel, bypassing message ownership checks due to missing authorization validation on the backend APIs. The issue is fixed in version 0.6.19.

Open WebUI versions prior to 0.1.124 contain a path traversal vulnerability in the file upload functionality. The file name derived from the HTTP upload request is not validated or sanitized, allowing attackers to use dot-segments to traverse directories and place files outside the intended upload directory. This can lead to arbitrary file writes anywhere the web server user has permission. The issue is fixed in version 0.1.124.

Open WebUI versions prior to 0.1.124 contain an authorization vulnerability where the API does not properly validate user roles. By default, new sign-ups receive a 'pending' role, requiring an administrator to manually assign 'user' or 'admin' roles before access is granted. This flaw allows unauthorized access to the web application until the user role is correctly assigned. The issue is fixed in version 0.1.124.

CVE-2026-45672 is an authorization vulnerability in open-webui versions prior to 0.8.12. The /api/v1/utils/code/execute endpoint allows any verified user to execute arbitrary Python code via Jupyter, even if the admin has disabled code execution via the ENABLE_CODE_EXECUTION setting. This occurs because the feature gate is not enforced on the API endpoint. The issue is fixed in version 0.8.12.

Open WebUI versions prior to 0.9.5 contain a server-side request forgery (SSRF) vulnerability due to a parsing discrepancy between the urlparse and requests libraries. This vulnerability allows an attacker with low privileges to cause the server to make unintended requests, potentially leading to high confidentiality impact. The issue is fixed in version 0.9.5.

CVE-2026-45402 is an authorization bypass vulnerability in open-webui versions prior to 0.9.5. Multiple endpoints accept a user-supplied file_id and attach the referenced file to resources controlled by the caller without verifying ownership or access rights. This allows any authenticated user who knows a file's UUID to exfiltrate or overwrite other users' private files. The issue affects specific API endpoints related to folder and knowledge-base management. The vulnerability is fixed in version 0.9.5.

Open WebUI versions prior to 0.9.5 contain a server-side request forgery (SSRF) vulnerability due to insufficient validation of HTTP redirect targets. Authenticated users can submit URLs that redirect to internal network addresses, allowing them to access internal resources via various API endpoints. This issue is resolved in version 0.9.5.

Open WebUI versions prior to 0.9.5 contain an authorization bypass vulnerability where users with read-only access can perform pin/unpin operations on messages. This occurs because the system only checks read permissions for these write operations in standard channels. The issue is fixed in version 0.9.5.

Open WebUI versions prior to 0.9.5 contain an authorization bypass vulnerability in the handling of knowledge base collections identified by raw UUIDs. Authenticated users who know a private knowledge base UUID can read and modify another user's knowledge base content via retrieval query and write endpoints. This issue is fixed in version 0.9.5.

Open WebUI versions prior to 0.9.5 have a missing authentication vulnerability in the GET /api/v1/retrieval/ endpoint. This endpoint returns live retrieval-augmented generation (RAG) pipeline configuration data without requiring any authorization, unlike adjacent endpoints which are properly protected. The issue is fixed in version 0.9.5.

Open WebUI versions prior to 0.9.5 have a vulnerability in the POST /api/v1/evaluations/feedback endpoint that allows authenticated attackers to perform mass assignment via the FeedbackForm. This flaw enables attackers to inject a user_id field that overwrites the server-derived value, leading to corrupted model evaluation leaderboards and identity spoofing. The issue is fixed in version 0.9.5.

Open WebUI versions prior to 0.9.5 contain an improper privilege management vulnerability in the tool update endpoint. This flaw allows users without proper tool management permissions to replace server-side Python code for tools and execute it, bypassing intended security boundaries. The issue is fixed in version 0.9.5.

A vulnerability in open-webui prior to version 0.9.5 allows users with read access to a model to also read the model's system prompt, which may be confidential. This exposure of sensitive information is classified as CWE-200. The issue is fixed in version 0.9.5.

An Insecure Direct Object Reference (IDOR) vulnerability exists in Open WebUI versions prior to 0.9.5 in the Channels feature. This flaw allows any member of a group or direct message channel to modify messages sent by other members, including administrators, due to insufficient ownership verification in the update_message_by_id function. The vulnerability is fixed in version 0.9.5.

Open WebUI versions prior to 0.9.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows any authenticated user with model creation permissions to inject arbitrary JavaScript that executes in the browsers of other users, including administrators, when they view the malicious model in the chat UI. The vulnerability is resolved in version 0.9.0.

CVE-2026-44550 is a missing authorization vulnerability in open-webui versions prior to 0.9.0. The issue arises because FolderForm uses a configuration that allows arbitrary fields to bypass validation, enabling an attacker to overwrite the server-assigned user_id with a malicious value in the POST request. This user_id is then persisted incorrectly, leading to unauthorized data manipulation. The vulnerability is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an improper authentication vulnerability in the LDAP authentication endpoint. The system does not validate that the submitted password is non-empty before attempting a Simple Bind to the LDAP server. This allows an empty password to pass validation and potentially authenticate successfully on vulnerable LDAP servers, resulting in issuance of a full session token for the targeted user. The vulnerability is fixed in version 0.9.0.

CVE-2026-44552 is a vulnerability in open-webui versions prior to 0.9.0 where multiple instances sharing a Redis database can experience key collisions due to unprefixed keys. This causes configuration data from one instance to overwrite another, exposing resource configurations across instances. The issue is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain a vulnerability where administrative role changes and user deletions do not properly disconnect affected Socket.IO sessions. This allows users whose admin privileges have been revoked to retain those privileges within their existing sessions until the connection is terminated. The issue is fixed in version 0.9.0.