Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

Open WebUI: Chat completion API allows tool restrictions to be bypassed

Open WebUI: Insecure Message Access Breaks Authorization

Open WebUI: responses passthrough endpoint lacks access control authorization

Open WebUI: Broken Access Control for Completions API

Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption

Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation

Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex

Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Open WebUI: Missing authorization check at the model update function - models from other users can be updated

Open WebUI: Exposure of System Prompt to Regular User [Non-Admin]

Open WebUI: Indirect Object Reference (IDOR) in user notes

Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Open WebUI: Model Import Overwrites Any Model Without Ownership Check

Open WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints

Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: Arena task endpoints can bypass underlying model access controls

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter