Cross-Site Request Forgery (CSRF) in open-webui/open-webui

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Open WebUI: Missing authorization check at the model update function - models from other users can be updated

Open WebUI: Exposure of System Prompt to Regular User [Non-Admin]

Open WebUI: Indirect Object Reference (IDOR) in user notes

Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Open WebUI: Model Import Overwrites Any Model Without Ownership Check

Open WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints

An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8

Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI is a user-friendly WebUI for LLMs

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: Arena task endpoints can bypass underlying model access controls

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Open WebUI: Stored XSS in Mermaid Markdown Preview

Open WebUI: Stored Cross-Site Scripting In Profile Picture

Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function

Open WebUI: Authenticated users can bypass model access control via exposed query parameter

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Open WebUI: Channel Access Grants Bypass filter_allowed_access_grants

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show