Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Open WebUI: Stored XSS in Mermaid Markdown Preview

Open WebUI: Stored Cross-Site Scripting In Profile Picture

Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function

Open WebUI: Authenticated users can bypass model access control via exposed query parameter

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Open WebUI: Channel Access Grants Bypass filter_allowed_access_grants

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI vulnerable to Stored XSS via iFrame in citations model

Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Open WebUI: Account enumeration via observable login timing discrepancy

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Open WebUI: Unauthenticated RAG Configuration Disclosure

Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Open WebUI: Calendar event re-parenting allows writing events into another user's calendar

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui