Open WebUI: Stored XSS via Model Description

Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

Open WebUI: Chat completion API allows tool restrictions to be bypassed

Open WebUI: Insecure Message Access Breaks Authorization

Open WebUI: responses passthrough endpoint lacks access control authorization

Open WebUI: Broken Access Control for Completions API

Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption

Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Open WebUI: Missing authorization check at the model update function - models from other users can be updated

Open WebUI: Exposure of System Prompt to Regular User [Non-Admin]

Open WebUI: Indirect Object Reference (IDOR) in user notes

Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Open WebUI: Model Import Overwrites Any Model Without Ownership Check

Open WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints

An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8

Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI is a user-friendly WebUI for LLMs

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: Arena task endpoints can bypass underlying model access controls

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin