Open WebUI versions from 0.6.31 up to but not including 0.11.4 contain a stored cross-site scripting (XSS) vulnerability in the Markdown renderer. This vulnerability arises because user-authored tool-call detail blocks are treated as tool output and their embeds attribute is mounted in script-enabled iframes. Authenticated users can exploit this by posting crafted messages or citation content that execute JavaScript in other users' browsers, potentially enabling in-app phishing or session hijacking if iframeSandboxAllowSameOrigin is enabled.
Open WebUI versions prior to 0.11.4 have a missing authorization vulnerability that allows authenticated users to access disabled model provider backends by specifying an explicit backend index. This can be done via path segments or query parameters on Ollama and OpenAI-compatible listing routes, potentially exposing API keys, version strings, and connection enumerations.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated users can exploit this by providing crafted file search patterns that cause catastrophic backtracking in regex processing, stalling server workers and blocking the event loop for approximately two seconds per repeated call. This vulnerability impacts availability but does not affect confidentiality or integrity.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain a denial of service vulnerability in the automation recurrence-rule validator. This vulnerability arises because the validator's sub-daily frequency guard parses rule text more strictly than the calendar library that executes it, allowing crafted rules to expand per second and block the shared event loop for minutes. The issue affects users permitted to create automations who can submit specially crafted recurrence rules that cause synchronous blocking on every scheduler poll.
Open WebUI versions from 0.6.42 up to but not including 0.11.4 contain a vulnerability where authenticated users can cause uncontrolled resource consumption. By supplying compressed remote image URLs in chat messages, attackers can trigger unbounded decompression of gzip-encoded responses, exhausting server memory and causing denial of service.
Open WebUI versions from 0.9.0 up to but not including 0.11.4 contain a denial of service vulnerability. Authenticated users with automations permission can submit unsatisfiable recurrence rules, such as February 30th, to the automations create or update endpoints. This causes the instance to stall by blocking the shared event loop for several seconds per request, resulting in denial of service.
Open WebUI versions 0.11.0 through before 0.11.4 contain a vulnerability where user-supplied grep patterns are compiled using a regex engine that can expand nested counted repetitions unboundedly at compile time. Authenticated users can exploit this by submitting short nested repetition patterns that cause the event loop to block and exhaust worker memory, leading to denial of service.
Open WebUI versions from 0.11.1 up to but not including 0.11.4 contain a stored cross-site scripting (XSS) vulnerability in the DocxPreview.svelte component. This flaw allows authenticated users to execute arbitrary scripts by uploading specially crafted DOCX files. Exploitation can lead to theft of a previewing administrator's session token from local storage, enabling instance takeover.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain an information disclosure vulnerability. Authenticated non-admin users with tool export permission can exploit this flaw to retrieve the full Python source code of read-only shared tools via a specific API endpoint. This exposure can reveal embedded API keys and credentials, potentially compromising sensitive information.
Open WebUI versions from 0.6.27 up to but not including 0.11.4 contain an information disclosure vulnerability that allows destination servers to obtain user session cookies during OAuth-mode connections. This vulnerability enables operators of OpenAI-compatible connections, OpenAPI tool servers, or terminal servers to capture and replay session cookies, potentially hijacking user accounts including those with administrative privileges.
Open WebUI versions before 0.11.4 have a stored cross-site scripting (XSS) vulnerability in the MarkdownInlineTokens.svelte component. This flaw allows authenticated users to inject javascript: links into markdown-rendered chat messages. When other users click these malicious links, their JSON Web Tokens (JWTs) stored in local storage can be stolen, including those of administrators.
Open WebUI versions from 0.6.33 up to but not including 0.11.4 contain a cross-site scripting (XSS) vulnerability. This flaw allows authenticated users to inject malicious scripts via the citation embed_url fields. When a victim clicks a crafted chat citation, the script executes in their session, potentially exposing sensitive tokens and enabling attacker impersonation.
Open WebUI versions from 0.9.6 up to but not including 0.11.4 contain an authorization flaw in the knowledge base file listing functionality. This flaw allows users with read access to any knowledge base to supply a directory_id that belongs to a different knowledge base, bypassing proper verification. As a result, the API endpoint GET /api/v1/knowledge/{id}/files returns breadcrumb information exposing folder names, owner user IDs, and knowledge base IDs for the supplied directory and its ancestor directories.
Open WebUI versions from 0.8.8 up to but not including 0.11.4 have an improper authorization vulnerability. This flaw allows users who have been deactivated to continue executing terminal commands via an already open terminal WebSocket connection. The vulnerability exists because the terminal proxy route only verifies access on the first message, enabling continued unauthorized command execution and file access.
Open WebUI versions from 0.7.0 up to but not including 0.11.4 have a cross-origin message handling vulnerability in the SyncStatsModal component. This flaw allows any website to steal a signed-in user's session token by sending unvalidated verify:chat messages. The vulnerability involves a path-traversal chat ID that redirects an authenticated stats export request to the authentication endpoint, exposing the victim's JWT token and enabling full API access.
Open WebUI versions from 0.11.0 up to but not including 0.11.4 have an improper authorization vulnerability in the chat fork handler. This flaw allows shared folder members who have been downgraded to read-only access to fork chats they originally created while having write access, placing attacker-controlled chats in the source chat's folder without verifying folder write permissions. This can lead to unauthorized insertion of chats visible to folder owners and members.
Open WebUI versions from 0.6.0 up to but not including 0.11.4 have an improper access control vulnerability in the has_access_to_file function. This flaw allows former knowledge base collaborators to retain access to files through stale cached references, enabling attackers with read or write permissions to download or delete files, including those in private knowledge bases.
Open WebUI versions from 0.11.1 up to but not including 0.11.4 contain an authorization bypass vulnerability in the OAuth token exchange endpoint. The flaw arises because the endpoint reads role claims only from the provider's userinfo response and retains the user's existing role if no roles claim is found, ignoring roles present only in the ID token. This allows users with linked accounts whose identity provider roles no longer meet the OAuth role policy to send a valid provider access token to the token exchange endpoint and obtain a session that retains their previous, potentially elevated, role.
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all files uploaded by users, which includes the ID values. The attacker can then use the GET /api/v1/files/{file_id} interface to obtain information on any file and the DELETE /api/v1/files/{file_id} interface to delete any file.