Open WebUI: Authenticated users can bypass model access control via exposed query parameter

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Open WebUI: Channel Access Grants Bypass filter_allowed_access_grants

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI vulnerable to Stored XSS via iFrame in citations model

Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Open WebUI: Account enumeration via observable login timing discrepancy

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Open WebUI: Unauthenticated RAG Configuration Disclosure

Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Open WebUI: Calendar event re-parenting allows writing events into another user's calendar

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui

Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint

Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering