Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Open WebUI: Stored XSS in excel file preview

Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`

Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url`

Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints

Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature

Open WebUI: Forged chat-file link allows cross-user file read and deletion

Open WebUI: Inconsistent authorization controls within memories API

Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI: Stored XSS in Banner Component via Improper Sanitization Order

Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal

Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

Open WebUI has unauthorized deletion of knowledge files

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

Open WebUI: Stored XSS via the HTML renedering view

Open WebUI has Broken Access Control in Tool Valves

Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy

Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI

Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls

Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

Open WebUI: Open WebUI Improper Authorization Control

Open WebUI: Stored XSS via Model Description

Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion