Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation

Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex

Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Open WebUI: Missing authorization check at the model update function - models from other users can be updated

Open WebUI: Exposure of System Prompt to Regular User [Non-Admin]

Open WebUI: Indirect Object Reference (IDOR) in user notes

Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Open WebUI: Model Import Overwrites Any Model Without Ownership Check

Open WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints

Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: Arena task endpoints can bypass underlying model access controls

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Open WebUI: Stored XSS in Mermaid Markdown Preview

Open WebUI: Stored Cross-Site Scripting In Profile Picture

Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function