Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Open WebUI: Stored XSS in Mermaid Markdown Preview

Open WebUI: Stored Cross-Site Scripting In Profile Picture

Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function

Open WebUI: Authenticated users can bypass model access control via exposed query parameter

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Open WebUI: Channel Access Grants Bypass filter_allowed_access_grants

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI vulnerable to Stored XSS via iFrame in citations model

Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc

Open WebUI: Account enumeration via observable login timing discrepancy

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Open WebUI: Unauthenticated RAG Configuration Disclosure

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Open WebUI: Calendar event re-parenting allows writing events into another user's calendar

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui

Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint

Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories