open-webui vulnerabilities and threats

Open WebUI versions prior to 0.9.0 contain a missing authorization vulnerability in the POST /api/v1/retrieval/process/web endpoint. This endpoint accepts a user-supplied collection_name and an overwrite parameter without verifying if the user has permission to modify the target collection. When overwrite is true, the system deletes the target collection before writing new content. This flaw allows unauthorized users with limited privileges to overwrite collections they do not own. The issue is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain a missing authorization vulnerability (CWE-862) in the model composition feature. This flaw allows users with default model creation permissions to create models that chain to restricted base models without proper access checks, enabling unauthorized use of admin-configured API keys. The issue is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an improper access control vulnerability in the /responses endpoint. This endpoint accepts any authenticated user and forwards requests to upstream LLM providers without enforcing per-model access control, allowing users to interact with any configured model by specifying an arbitrary model ID. The issue is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization flaw in the _validate_collection_access function. This flaw allows any authenticated user to access the system-level meta-collection that indexes all knowledge bases on the instance, bypassing intended ownership checks. The vulnerability is resolved in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization bypass vulnerability in the channel router. Non-admin users who can create or own group channels can submit arbitrary access grants, including public wildcard grants, which are stored without proper permission checks. This bypasses the admin permission framework and allows unauthorized access. The issue is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization flaw in the GET /api/v1/channels/{id}/members endpoint. This flaw allows any authenticated user who knows a private channel's UUID to enumerate all members of that channel without proper access checks. The issue is resolved in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain a missing authorization vulnerability in the get_sources_from_items function. This flaw allows unauthorized users to perform vector store queries on files and knowledge bases they should not access. The issue is resolved in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization vulnerability where deactivated users retain read and write access to channels. This occurs because the is_user_channel_member function does not verify the is_active status of a user's membership, allowing users marked as inactive to still access channel data via API calls. The issue is resolved in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization bypass vulnerability in the POST /api/v1/models/import endpoint. This flaw allows users with the workspace.models_import permission to overwrite any existing model in the database regardless of ownership. The endpoint merges the attacker's payload over existing model data without validating ownership or access grants, bypassing normal access control checks. This vulnerability is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain a missing authorization vulnerability in several API endpoints. The /api/generate, /api/embed, /api/embeddings, and /api/show endpoints accept any model name from authenticated users without verifying if they have access rights to that model. This allows authenticated users to access models they are not authorized to use. The issue is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization flaw in the ydoc:document:update Socket.IO event handler. The handler verifies membership in the document's Socket.IO room but does not check if the user has write permissions. As a result, users with only read access can send update events that modify the document state in memory, affecting all collaborators in real time. This issue is resolved in version 0.9.0.

CVE-2026-44568 is a cross-site scripting (XSS) vulnerability in open-webui versions prior to 0.9.0. The issue arises from improper sanitization order when rendering admin-configured "Pending User Overlay Content" in the AccountPending.svelte component. This allows an admin to inject arbitrary JavaScript that executes in the browser context of any pending user viewing the overlay. The vulnerability is fixed in version 0.9.0.

CVE-2026-45331 is a server-side request forgery (SSRF) vulnerability in open-webui versions prior to 0.9.0. The issue arises because the validators library used for URL validation does not properly implement private IPv6 address filtering, causing the validation function to incorrectly allow all IPv6 addresses. Additionally, IPv4-mapped IPv6 addresses and certain reserved IPv4 ranges are not blocked, enabling attackers to bypass intended network restrictions. This vulnerability is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization bypass vulnerability where API keys restricted from accessing the /api/v1/messages endpoint can still access it if the key is sent via the x-api-key header instead of the Authorization header. This flaw allows unauthorized API access and model invocation. The issue is fixed in version 0.9.0.

CVE-2026-45349 is an authorization bypass vulnerability in open-webui versions prior to 0.9.0. It allows a user to use their own API key along with the Chat ID of another user to continue that user's conversation without proper authorization. This flaw was fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization vulnerability where low-privileged authenticated users can enumerate and stop background tasks belonging to other users. This flaw affects the integrity and usability of multi-user deployments by allowing disruption of system-wide chat usage. The issue is fixed in version 0.9.0.

Open WebUI versions prior to 0.9.0 contain an authorization bypass vulnerability allowing any authenticated user to permanently delete files owned by other users if those files are referenced in any shared chat. This occurs because the authorization check does not verify the requesting user's identity or the type of operation, and file UUIDs are disclosed to users with read access to the knowledge base. The vulnerability is fixed in version 0.9.0.

CVE-2026-45675 is a privilege management vulnerability in open-webui versions prior to 0.9.0. The issue arises from a TOCTOU race condition in the LDAP and OAuth authentication flows during first-user admin role assignment. While the regular signup handler was patched to prevent this race, the LDAP and OAuth code paths were not updated, allowing improper privilege escalation. This vulnerability is fixed in version 0.9.0.

Open WebUI versions 0.6.34 and below contain a DOM-based Cross-site Scripting (XSS) vulnerability in the custom prompt insertion feature when 'Insert Prompt as Rich Text' is enabled. This occurs because user-supplied prompt content is assigned to the DOM via innerHtml without sanitization. Users with permission to create prompts can embed malicious scripts that execute when other users invoke the corresponding command. The vulnerability is fixed in version 0.6.35.

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all files uploaded by users, which includes the ID values. The attacker can then use the GET /api/v1/files/{file_id} interface to obtain information on any file and the DELETE /api/v1/files/{file_id} interface to delete any file.